Cybersecurity News Roundup: AI Malware, GitHub Supply Chain Attacks, and Crypto-Exchange Convictions

SecurityWeek’s weekly cybersecurity news roundup offers a concise, comprehensive overview of important developments that may not receive full standalone coverage yet remain fundamentally relevant to the broader, fast-moving threat landscape. This curated summary highlights key stories across vulnerability disclosures, emerging attack methods, policy updates, industry reports, and other noteworthy events to help readers stay well-informed about the evolving digital security environment. From clever command-and-control infrastructures hidden in plain sight to severe supply chain compromises and landmark criminal convictions, this week’s developments underscore the relentless ingenuity of modern threat actors and the complex challenges facing defenders across the globe.

PoeLLM Malware Finds Its C&C Server Hidden in a GitHub Poem

Among the most novel discoveries of the week, threat intelligence researchers at Black Lotus Labs detailed a sophisticated malware strain dubbed PoeLLM. Active since at least April 2026, PoeLLM specifically targets exposed artificial intelligence and open-source enterprise services—primarily LiteLLM, Ollama, Gotenberg, and Gitea—with the ultimate objectives of mining cryptocurrency and expanding a growing botnet.

What makes PoeLLM particularly notable is its evasion and communication mechanism. Once an environment is successfully compromised, the infected machine extracts four specific keywords from a poem hosted publicly on GitHub. These words are then dynamically converted into the precise IP address of the current command-and-control (C&C) server. This ingenious design allows the threat operator to seamlessly switch infrastructure simply by altering those words within the poem repository. According to telemetry and code analysis, the operator behind the campaign is assessed to be Italian-speaking and has already updated the embedded poem eleven times to adapt to defensive disruptions and maintain continuous control over the botnet.

GhostAction Secret Theft Spreads to 772 More GitHub Repositories

Software supply chain security continues to face severe headwinds. Security firm GitGuardian reported that the GhostAction supply chain campaign aggressively pushed its secret-stealing GitHub Actions workflow to an additional 772 public repositories between August 31 and September 30. These repositories belong to 373 distinct users and organizations, putting an estimated 2,577 sensitive secrets at immediate risk, including SSH keys, database credentials, and access tokens for major cloud providers like AWS and Microsoft Azure.

While the attackers introduced a new exfiltration server to process the harvested credentials, analysts noted that they largely reused their established 2025 playbook. GitGuardian’s data indicates that this campaign has never truly stopped, continuously probing and exploiting automated workflows to harvest credentials before developers can detect and revoke them.

Jury Convicts Uranium Finance Hacker Over Multi-Million Dollar Exploits

In the courtroom, federal prosecutors secured a significant victory against cryptocurrency-related cybercrime. A jury has convicted 36-year-old Jonathan Spalletta of Maryland on multiple counts of computer fraud and money laundering stemming from two high-profile hacks against the decentralized cryptocurrency exchange Uranium Finance back in 2021.

Spalletta exploited critical flaws in the platform’s smart contracts to siphon roughly $1.4 million in an initial breach, followed by a devastating $53.3 million secondary attack that ultimately forced the exchange to shut down entirely. Following the thefts, he attempted to obscure the trail by laundering the stolen funds through a complex series of crypto transactions, which included utilizing privacy-focused mixing services like Tornado Cash.

Investigators discovered that the illicit proceeds were subsequently used to purchase luxury alternative investments, including rare Magic: The Gathering and Pokémon cards, as well as antique Roman coins. Spalletta now faces a severe legal reckoning, with up to 10 years in prison on the computer fraud count and an additional 20 years on the money laundering count when sentencing is finalized.

CISA Narrows Cyber Retention Pay Eligibility Amid Management Overhaul

On the domestic policy front, the Cybersecurity and Infrastructure Security Agency (CISA) has announced adjustments to its internal compensation structures. CISA will maintain its Cybersecurity Retention Incentive program—which provides eligible employees with financial bonuses worth up to 25 percent of their base salary—through fiscal year 2027. However, under newly instituted criteria, staff members must now hold an "exceeds expectations" performance rating or higher, and they must spend at least 51 percent of their daily working hours performing core cyber duties within one of three designated job series.

For employees outside of those specific series who still dedicate 75 percent or more of their time to cybersecurity work, a special review board has been established to handle applications. This policy overhaul directly follows a critical finding by the Department of Homeland Security’s inspector general, which concluded that the previous iteration of the retention program had been mismanaged and applied far too broadly across the agency.

Coalition Maps Out Requirements for Federal OT Cybersecurity Directive

Addressing critical infrastructure vulnerabilities, the Operational Technology Cybersecurity Coalition (OTCC) has published a detailed proposal calling for a binding operational directive (BOD) from CISA that focuses exclusively on operational technology (OT) across federal civilian agencies. These civilian agencies currently rely on more than 8,000 General Services Administration-managed facilities that house complex building management networks, including HVAC systems, power management infrastructure, access control systems, and automated building controls.

The coalition’s framework urges CISA to mandate that federal agencies officially designate a senior official or specialized office directly accountable for OT security. Furthermore, the proposed directive would require agencies to strictly enforce existing regulatory requirements while prioritizing CISA’s overarching Cybersecurity Performance Goals to secure physical facilities against remote disruption.

Domino’s Resets Customer Accounts Hijacked via Recycled Passwords

In the retail sector, fast-food giant Domino’s began notifying a small group of customers that their online accounts had been accessed by unauthorized third parties. The security incident was traced back to credential stuffing attacks, where malicious actors automated the process of testing email and password pairs that had been previously leaked in unrelated, third-party data breaches.

Domino’s emphasized that its core ordering systems and network infrastructure were never compromised during the incidents, and the company does not store customer payment card details directly on its user profiles. Nevertheless, as a proactive security measure, the company has successfully forced password resets for all affected accounts to lock out the unauthorized interlopers.

AI Under Suspicion as South Korea Proves Bank Cyberattacks

International cyber intelligence efforts turned toward East Asia this week, as South Korean President Lee Jae Myung publicly stated that investigators have found clear indications that artificial intelligence was utilized in a wave of recent cyberattacks targeting the nation’s financial institutions. Local law enforcement agencies have launched a full-scale investigation into the breaches, which successfully compromised sensitive customer personal information.

While authorities have not yet disclosed the exact AI frameworks deployed or the full operational scope of the breaches, private sector security researchers have begun filling in the technical details. Cybersecurity firm CrowdStrike reported finding Claude Code session histories, ARTEX configuration files, and Claude memory files while examining the threat actor’s infrastructure. Based on this telemetry, CrowdStrike assesses with moderate confidence that a Chinese-speaking, financially motivated threat actor group is likely behind the sophisticated financial sector intrusions.

Empire Market Co-Founder Sentenced to Four Decades Behind Bars

Federal law enforcement also closed the book on one of the dark web’s most notorious illicit marketplaces. Raheim Hamilton, a 30-year-old resident of Virginia, was sentenced to 40 years in federal prison and ordered to pay a $5 million fine. Hamilton had previously pleaded guilty to a major drug conspiracy charge for his role as the co-creator and co-operator of Empire Market, which he ran alongside Thomas Pavey between 2018 and 2020.

During its operational lifespan, Empire Market facilitated more than four million transactions valued at over $430 million. While the vast majority of the sales involved illicit narcotics, the platform also served as an open bazaar for stolen financial credentials, compromised personal identifying information, counterfeit currency, and advanced hacking tools. Pavey, who entered a guilty plea to related charges last year, is scheduled to receive his own federal sentencing later this month.

Exposed Nvidia DCGM Exporters Leak Telemetry From 12,000 GPUs

In hardware and infrastructure vulnerability news, security researchers disclosed CVE-2026-47483, a high-severity security flaw impacting Nvidia’s DCGM Exporter GPU monitoring tool. The vulnerability allows unauthenticated, remote attackers to flood profiling endpoints with crafted requests, completely exhausting system resources and causing the monitoring service to crash. This disruption can severely degrade or halt critical AI training and inference workloads running on the affected host hardware.

During global internet-wide scans conducted between March and May 2026, researchers discovered approximately 2,100 hosts carelessly exposing the DCGM exporter directly to the public internet without any authentication mechanisms in place. This exposure inadvertently leaked detailed performance telemetry from more than 12,000 high-performance GPUs. Nvidia has since released security updates addressing the flaw, and administrators are strongly advised to update their deployments to version 4.8.2 or later immediately.

Shai-Hulud-Style Worm Slips Into Tensorlake’s npm SDK

Rounding out the week’s supply chain threats, software repository monitors caught a severe compromise within the JavaScript ecosystem. Version 0.5.144 of tensorlake, the official npm software development kit for Tensorlake’s AI agent sandboxes, was maliciously modified to execute a credential-stealing worm automatically upon installation. Security analysts from Socket and Sonatype categorized the incident as a ChainDrop or Shai-Hulud-style supply chain attack.

The embedded malware is designed to aggressively harvest sensitive tokens and credentials for npm, GitHub, AWS, Kubernetes, and HashiCorp Vault, alongside configuration files utilized by popular AI coding assistants. Furthermore, the payload possesses the capability to execute arbitrary code supplied remotely by the attacker and can automatically propagate itself by republishing malicious updates through any secondary packages that the compromised victim holds publishing rights to.