We’ve gathered the most important cybersecurity news from the past week.

  • Microsoft disabled dozens of repositories on GitHub following a breach affecting Claude Code users.
  • Hacktivists targeted users in Ukraine using a vulnerability in WinRAR.
  • OpenClaw failed phishing tests.
  • A disgruntled researcher continued his "war" with Microsoft after patches for previous vulnerabilities.

Microsoft Disabled Dozens of GitHub Repositories After Claude Code User Breach

Microsoft temporarily restricted access to dozens of its open-source repositories on GitHub after malware was injected into the code. The hacker campaign, dubbed Miasma, was reported by analysts from Cloudsmith and OpenSourceMalware.

At least 70 projects were affected, many linked to the Azure platform. These repositories contained tools used by developers for AI coding applications, including Claude Code, Gemini CLI, and VS Code.

Experts noted that the malware was designed to steal passwords and other sensitive credentials, activating when users opened the compromised tools.

Cloudsmith recommended taking protective measures:

  • Immediately change SSH keys, GitHub tokens, passwords for cloud services (Azure/GCP), and access to automated build systems;
  • Look for hidden processes in code editors (VS Code), unfamiliar AI utilities, and new suspicious folders (repositories) in the company's GitHub;
  • In the future, avoid downloading updates for third-party libraries from the internet. Create a list of approved programs and keep track of them.

Microsoft representative Ben Hope stated in comments to TechCrunch that the company temporarily removed some repositories to check for potentially malicious content. Some of these have already been restored.

Hacktivists Target Ukrainian Users via WinRAR Vulnerability

Hacktivist groups SHADOW-EARTH-066 (UAC-0226) and Gamaredon attacked Ukrainian government institutions through a vulnerability in the WinRAR archiver. This was reported by researchers from Trend Micro and Sekoia.

The directory traversal flaw allows attackers to save malicious files outside the target folder—directly into the startup folder—when extracting an archive.

An example of a bait document used to create a sense of urgency and compel interaction. Source: Trend Micro. 

According to specialists, the infection chains are structured as follows:

  • SHADOW-EARTH-066: Uses archives with fake PDF documents to stealthily install the info stealer GIFTEDCROOK, which steals passwords from browsers and target documents. Notably, due to restrictions in Russia, hackers have stopped using Telegram for data exfiltration, switching to their own servers;
  • Gamaredon: This group, linked to the FSB, employs the exploit on an "industrial scale." Their multi-stage attack deploys loaders that deliver the GammaWorm (spreads via infected USB drives) and the GammaSteel stealer (uploads stolen files to AWS cloud).

Experts note that the deep integration of the outdated version of WinRAR into the daily operations of organizations in Ukraine makes it an ideal entry point for hacker campaigns.

OpenClaw Fails Phishing Tests

Researchers from Varonis tested OpenClaw as an AI agent for email handling and concluded that the system is vulnerable to tactics typically used against humans.

In the experiment, they simulated four phishing attacks and assessed the agent's behavior in two configurations. OpenClaw was connected to Gmail, browser tools, Google Workspace API, and a set of synthetic internal data. 

The framework was tested based on Google Gemini 3.1 Pro and OpenAI GPT-5.4 in both standard and "strict" modes with separate instructions for identity verification and anti-phishing procedures.

Source: Varonis.

Phishing attack simulations included:

  • Impersonating a team leader requesting access to a test environment during a supposed issue in the work environment. OpenClaw found and sent AWS IAM keys, database credentials, and SSH access details to an external Gmail account;
  • Requesting a client data dump under the pretext of remote work on a presentation. The agent extracted and sent a CRM dump containing client records, contact information, contract details, and income data without verifying the sender's identity;
  • The AI system received a fake email with a gift card containing a phishing link. In standard configuration, the agent visited the phishing site and attempted to activate the gift card using fictitious credentials before ultimately recognizing the page as malicious. The strict configuration blocked the attack immediately;
  • Researchers created a malicious Google OAuth application disguised as a time-tracking platform. OpenClaw checked the OAuth authorization process, analyzed the destination, identified the application as suspicious, and denied access.

Disgruntled Researcher Continues "War" with Microsoft After Patching Previous Vulnerabilities

A cybersecurity researcher known as Nightmare Eclipse revealed a new zero-day vulnerability in Microsoft Defender, dubbed RoguePlanet.

The exploit allows attackers to escalate their privileges to the highest SYSTEM level and execute arbitrary code even on fully updated machines running Windows 10 and Windows 11.

This incident continues the public conflict between the hacker and the IT giant. Back in April, Nightmare Eclipse promised to publish zero-day vulnerabilities after each patch released by Microsoft engineers. The June update just closed several of his previous findings (GreenPlasma, MiniPlasma, and YellowKey), prompting the immediate release of RoguePlanet.

Cybersecurity experts from ThreatLocker, in comments to BleepingComputer, confirmed that they successfully reproduced the attack during their own testing. They verified that the exploit works on fully updated Windows 11 systems with patch KB5094126 installed.

Korean Tech Giant Fined $400 Million for Data Breach

The Personal Information Protection Commission of South Korea (PIPC) imposed a record fine of 624.6 billion won (approximately $409 million) on tech giant Coupang following a massive data breach.

According to the regulator, insufficient security measures—including issues with authentication key management and access control—led to the exposure of personal data for about 37.55 million individuals. Coupang's subsidiary, Coupang Fulfillment Service, received a separate fine of 248 million won for the illegal collection, use, and processing of personal and sensitive customer data.

PIPC also noted violations of data destruction and breach notification requirements, as well as interference with the work of an independent data protection officer and obstruction of the investigation.

The breach occurred in June 2025 but was only discovered in November. A month later, Coupang reported the compromise of 33.7 million accounts. Law enforcement identified the main suspect as a 43-year-old Chinese national who worked in the company's IT department from 2022 to 2024.

Also on ForkLog:

  • Europol shut down the crypto service AudiA6.
  • The head of Anthropic called for stricter oversight of AI models.
  • Meta removed the facial recognition feature from smart glasses after a scandal.
  • The Raydium liquidity pool was hacked for $1.34 million.
  • The Humanity Protocol token collapsed after a $31 million hack.
  • Yuga Labs rescued NFTs worth $500,000.

What to Read This Weekend?

ForkLog explored the business model of Strategy, examining why critics label it a financial pyramid while supporters view it as an example of effective risk management.