Weekly Cybersecurity Roundup: AI Malware, GitHub Supply Chain Attacks, and Crypto-Exchange Convictions

SecurityWeek’s weekly cybersecurity news roundup offers a comprehensive and concise overview of critical developments across the global threat landscape. While many of these stories may not receive immediate standalone coverage, they remain profoundly relevant to enterprise security posture, vulnerability management, and shifting adversary tactics. From novel malware deployment strategies leveraging artificial intelligence to sweeping supply chain compromises and landmark federal convictions, this week’s curated summary highlights the key events shaping the modern security environment.

PoeLLM Malware Finds Its C&C Server Hidden in a GitHub Poem

Security researchers have uncovered a novel and creative command-and-control mechanism deployed by threat actors in the wild. Black Lotus Labs has detailed a malware strain dubbed PoeLLM, which has been active since at least April 2026. The threat targets exposed artificial intelligence and open-source services—predominantly LiteLLM, Ollama, Gotenberg, and Gitea—with the primary objectives of cryptomining and expanding a distributed botnet.

What sets PoeLLM apart is its operational infrastructure. Once a machine is successfully infected, the malware extracts four specific keywords from a poem hosted on a public GitHub repository. It then converts these extracted keywords into the IP address of its active command-and-control server. This design allows the threat actor to pivot and update their infrastructure simply by modifying the text of the GitHub poem. According to telemetry, the operator, who is assessed with moderate confidence to be an Italian-speaking individual, has already updated the poem 11 times to shift server locations and evade automated takedowns.

GhostAction Secret Theft Spreads to 772 More GitHub Repositories

The software supply chain continues to face relentless pressure from automated threat campaigns. Security firm GitGuardian reported that the GhostAction supply chain campaign aggressively pushed its secret-stealing GitHub Actions workflow to an additional 772 public repositories between August 31 and September 30. These repositories belong to 373 distinct users and organizations.

The campaign specifically targets highly sensitive data, casting a wide net over 2,577 unique secrets, including critical SSH keys alongside credentials for Azure, Amazon Web Services, and various database architectures. Analysts noted that apart from utilizing a newly established exfiltration server, the perpetrators largely reused their established 2025 playbook. GitGuardian’s continuous monitoring data indicates that this malicious campaign has operated persistently without significant operational downtime.

Jury Convicts Uranium Finance Hacker Over Multi-Million Dollar Exploits

In a major legal victory for federal prosecutors targeting cryptocurrency crimes, a federal jury has convicted 36-year-old Jonathan Spalletta of Maryland on charges of computer fraud and money laundering. The conviction stems from two devastating 2021 cyberattacks targeting the decentralized cryptocurrency exchange Uranium Finance.

Spalletta exploited fundamental vulnerabilities within the platform’s smart contracts to steal approximately $1.4 million in his initial attack, followed by a staggering $53.3 million in a secondary breach that ultimately forced Uranium Finance to shut down operations permanently. Following the thefts, the perpetrator attempted to launder the stolen funds through a complex series of cryptocurrency transactions, which included routing assets through the Tornado Cash mixing service. He then converted the digital loot into tangible physical collectibles, purchasing rare Magic: The Gathering and Pokémon cards, alongside antique Roman coins. Spalletta now faces a maximum potential sentence of 10 years in prison for the fraud count and up to 20 years for money laundering.

CISA Narrows Cyber Retention Pay Eligibility Criteria

The Cybersecurity and Infrastructure Security Agency is recalibrating its internal compensation incentives. CISA has announced that it will maintain its Cybersecurity Retention Incentive program—which provides bonuses worth up to 25% of an employee’s base salary—through fiscal year 2027. However, under newly established criteria, a smaller fraction of the workforce will qualify.

To remain eligible, staff members must now maintain an "exceeds expectations" or higher performance rating and dedicate at least 51% of their working hours to core cybersecurity duties within one of three designated job series. Personnel operating outside these specific series who spend 75% or more of their time on cyber-related tasks must now formally apply to an internal review board for consideration. This structural overhaul follows a Department of Homeland Security inspector general investigation that concluded the previous iteration of the incentive program suffered from mismanagement and was applied far too broadly.

Coalition Maps Out Requirements for Federal OT Cybersecurity Directive

Recognizing the escalating vulnerabilities within critical infrastructure, the Operational Technology Cybersecurity Coalition has published a formal proposal calling for a binding operational directive from CISA centered exclusively on operational technology used by federal civilian agencies. These agencies currently rely on more than 8,000 facilities managed by the General Services Administration, housing critical physical infrastructure such as heating, ventilation, and air conditioning systems, power management frameworks, physical access control systems, and building automation networks.

The coalition’s proposal urges CISA to mandate that federal agencies formally designate a senior official or specialized office with direct accountability for OT security. Furthermore, the directive would require agencies to enforce relevant existing security requirements while prioritizing alignment with CISA’s overarching Cybersecurity Performance Goals.

Domino’s Resets Customer Accounts Hijacked via Recycled Credentials

Fast-food giant Domino’s has initiated password resets for a limited number of customer accounts after detecting unauthorized third-party access. The intrusions were carried out via credential stuffing attacks, wherein malicious actors leverage email and password pairs leaked during unrelated, third-party data breaches.

Domino’s emphasized that its corporate systems and internal databases were not compromised during the incident, and noted that the platform does not store sensitive payment card details. Nevertheless, as a precautionary measure, the company forced password resets on all affected accounts to thwart further unauthorized access attempts.

AI Under Suspicion as South Korea Probes Major Bank Cyberattacks

South Korean authorities have launched a full-scale investigation into a series of sophisticated cyberattacks targeting the nation’s financial institutions, which resulted in the exposure of sensitive customer personal information. President Lee Jae Myung publicly noted that there are strong indications artificial intelligence technologies were leveraged during the execution of these attacks.

While investigators have not yet disclosed the specific AI tools utilized or the exact magnitude of the data breaches, security vendor CrowdStrike reported uncovering significant artifacts during infrastructure analysis. Researchers identified Claude Code session histories, ARTEX configuration files, and Claude memory files. Based on these technical indicators, CrowdStrike assesses with moderate confidence that a Chinese-speaking, financially motivated threat actor group is likely responsible for the campaign.

Empire Market Co-Founder Sentenced to Four Decades Behind Bars

Federal authorities have secured a lengthy prison sentence for a major figure in the dark web ecosystem. Raheim Hamilton, a 30-year-old resident of Virginia, was sentenced to 40 years in federal prison and ordered to pay a $5 million fine. Hamilton previously pleaded guilty to a drug conspiracy charge stemming from his role as the co-creator and operator of Empire Market, an illicit dark web marketplace he ran alongside Thomas Pavey between 2018 and 2020.

During its operational lifespan, the marketplace facilitated more than four million transactions totaling over $430 million in volume, primarily driven by illicit drug sales. The platform also served as a bazaar for stolen credentials, compromised personal information, counterfeit currency, and specialized hacking tools. Pavey, who entered a guilty plea last year, is scheduled to receive his sentencing later this month.

Exposed Nvidia DCGM Exporters Leak Telemetry From Thousands of GPUs

A high-severity vulnerability tracked as CVE-2026-47483 has been disclosed in Nvidia’s DCGM Exporter, a widely utilized GPU monitoring utility. The flaw allows unauthenticated remote attackers to inundate the application’s profiling endpoints with crafted requests, inducing severe resource exhaustion and crashing the service. This disruption can severely degrade or stall artificial intelligence and machine learning workloads executing on the same host infrastructure.

During security scans conducted between March and May 2026, researchers discovered approximately 2,100 enterprise hosts inadvertently exposing the monitoring exporter directly to the public internet without any authentication barriers, thereby leaking detailed hardware telemetry from more than 12,000 graphics processing units. Nvidia has issued security updates addressing the vulnerability, urging system administrators and enterprises to upgrade immediately to version 4.8.2 or later.

Shai-Hulud-Style Worm Slips Into Tensorlake’s NPM Software Development Kit

The open-source software ecosystem has experienced another high-profile supply chain compromise. Version 0.5.144 of tensorlake, the official npm software development kit for Tensorlake’s AI agent sandboxes, was maliciously modified to execute a credential-harvesting worm during the package installation process. Security analysts from Socket and Sonatype categorized the incident as a ChainDrop or Shai-Hulud style supply chain attack.

According to the analysis, the malicious payload systematically scavenges the host environment for sensitive authentication tokens and credentials spanning npm, GitHub, Amazon Web Services, Kubernetes, and HashiCorp Vault, alongside configuration files utilized by modern AI coding assistants. Furthermore, the malware possesses the capability to execute arbitrary code provided by the remote operator and can autonomously propagate itself by republishing malicious updates through other npm packages controlled or publishable by the victim.