GhostAction campaign, scam centers grow, GPUGate hits IT

Summary

---

Cyber Security Headlines – September 9, 2025

Podcast: Cyber Security Headlines
Host: Rich Stroffolino, CISO Series
Main Theme:
A fast-paced overview of the top stories in information security, highlighting major breaches, novel cybercrime campaigns, new vulnerabilities, and trends impacting the tech and legal sectors.

---

Key Discussion Points & Insights

1. GhostAction Campaign Targets GitHub

[00:07–01:15]

• Incident Overview: GitGuardian discovered that their internal FastUUID GitHub project was compromised. The attack enumerated secrets from workflow files and hardcoded secret names into workflows.
• Scope: The wider campaign, dubbed "GhostAction", affected 327 GitHub users and 817 repositories, leaking over 3,300 secrets including AWS instances, Docker Hub, and npm tokens.
• Response: GitGuardian notified security teams at GitHub, PyPI, and npm; many repositories were already reverted to mitigate the leak.

Memorable Quote:

“This campaign leaked over 3,300 secrets, including AWS instances, Docker Hub tokens and npm tokens.”
— Rich Stroffolino, [00:45]

---

2. Industrial-scale Scam Centers Proliferate in Myanmar

[01:16–01:43]

• Scale & Location: New research and drone footage reveal that scam call centers on the Thai-Myanmar border have more than doubled since the 2021 military coup.
• Construction Rate: New criminal compounds are being built at a staggering rate of 55 hectares per month.
• Human Trafficking: Thai police estimate at least 100,000 individuals are trafficked into these centers, lured by false job promises.
• Criminal Innovation: Fortified centers include luxury accommodations for management, serving as “social proof” for various investment scams.

Quote:

“These elaborate facilities are heavily fortified and contain luxury housing for management as well as serving as social proof for investment scams.”
— [01:38]

---

3. Chinese APT41 Impersonates US Lawmaker in Cyber-espionage Campaign

[01:44–02:20]

• Attack Method: APT41 (Chinese-backed advanced persistent threat group) orchestrated an email campaign posing as U.S. Congressman John Moliner (CH), targeting trade groups, U.S. government agencies and law firms.
• Malware Delivery: The phishing emails included attachments appearing to be draft legislation, designed to prompt user interaction and install a backdoor.
• Context: Occurred at the onset of US–China trade talks in Sweden.

Quote:

“An investigation by Google’s Mandiant found that clicking on the attachments would attempt to install a backdoor.”
— [02:08]

---

4. ‘GPUgate’: New Malvertising Tactic Targets IT Firms

[02:21–03:07]

• Attack Mechanism: Dubbed 'GPUgate', the campaign uses paid ads in search results containing GitHub commit URLs leading to malicious downloads.
• Technical Innovation: The malware’s payload is locked behind a “GPU-gated decryption routine”—if the system lacks a GPU (as is typical in sandboxes or VMs), the malware remains encrypted, evading analysis.
• Target Profile: Exclusively targets IT and software development companies in Western Europe; operators speak Russian.

Quote:

“This would stymie analysis of the malware on a virtual machine or other sandbox that doesn’t typically have GPU resources.”
— [02:49]

---

5. iCloud Calendar Used for Advanced Phishing Scheme

[03:50–04:28]

• Phishing Details: Scammers sent fake PayPal billing notices via iCloud Calendar events to a Microsoft 365 mailing list.
• Technique: The phishing approach successfully passed SPF, DMARC, and DKIM checks, raising the stakes for anti-phishing defenses.

Quote:

“While the phishing lure is an extremely tried and true approach, the way it was delivered successfully passed SPF, DMARC and DKIM email security checks.”
— [04:23]

---

6. Wealthsimple Data Breach Impacts 1% of Customers

[04:29–04:52]

• Scope: Fintech firm Wealthsimple confirmed a breach exposing government IDs, SINs, and account numbers of 30,000 clients (under 1% of customer base).
• Cause: Stemming from a compromised third-party provider, identified on August 30th; affected customers notified by September 5th.
• Remediation: Two years of credit and dark web monitoring offered; customers urged to enable two-factor authentication.

---

7. PACER Struggles with Multi-Factor Authentication Rollout

[04:53–05:28]

• System: PACER, the US government’s case file access system, is trying to enforce MFA for document filers and case managers.
• Problems: Enrollment freeze-ups, overwhelmed support lines, and long wait times prompted a delay from a hard deadline to a phased rollout.
• Advice: Users should wait to enroll until the system prompts them.

---

8. Signal Launches Encrypted Chat Backup with Paid Option

[05:29–06:16]

• Feature: Signal introduces beta chat backup for Android—free for basic usage (100MB of chat, 45 days media), and paid plan ($1.99/month) for up to 100GB.
• Privacy: Backups are encrypted with a 64-character key generated on-device; backups are not linked to user identity or payment info.
• Significance: This is Signal’s first paid feature, previously funded solely by donations; iOS support coming soon.

---

Notable Quotes & Moments

• “This campaign leaked over 3,300 secrets, including AWS instances, Docker Hub tokens and npm tokens.” — Rich Stroffolino, [00:45]
• “These elaborate facilities are heavily fortified and contain luxury housing for management as well as serving as social proof for investment scams.” — [01:38]
• “An investigation by Google’s Mandiant found that clicking on the attachments would attempt to install a backdoor.” — [02:08]
• “This would stymie analysis of the malware on a virtual machine or other sandbox that doesn’t typically have GPU resources.” — [02:49]
• “While the phishing lure is an extremely tried and true approach, the way it was delivered successfully passed SPF, DMARC and DKIM email security checks.” — [04:23]

---

Additional Segments

• Editorial Note:
  The show highlights an episode tackling the perennial gap between security “prevention” advice and workplace adoption, with the tongue-in-cheek title:

  “We all agree that prevention is the best advice we’re never going to follow.” — [06:47]

• Community Engagement:
  Listeners are encouraged to send feedback to the show, which “reads everything that you send us and we love to hear from you.” — Rich Stroffolino, [07:02]

---

Conclusion

This episode provides a succinct but comprehensive sweep of major infosec stories—from elite cyber-espionage and creative malware distribution to practical security headaches for end users and institutions. The recurring message: threats are evolving, prevention is complex, and community awareness is critical.

---

Transcript

[A]

From the CISO series. It's Cybersecurity Headlines.

[B]

These are the cybersecurity headlines for Tuesday, September 9, 2025. I'm Rich Stroffelino Ghost Action Campaign targets GitHub On September 2, GitGuardian discovered that the account for a GitHub project they use internally, FastUUID, was compromised. That compromised account enumerated secrets from workflow files, then hardcoded secret names into the workflows. Looking into that particular compromise, the company found indicators of compromise indicating a larger campaign dubbed Ghost action, impacting 327 GitHub users and 817 repositories. This campaign leaked over 3,300 secrets, including AWS instances, Docker Hub tokens and npm tokens. GitGuardian notified GitHub, PyPi and npm security teams about the campaign, with many already reverting repositories. Scam Centers see Huge Growth in Myanmar the Guardian reports that according to new research and drone footage, the number of industrial scale scam call centers on the Thai Myanmar border has more than doubled since the Myanmar military coup in 2021.

[C]

With construction of new facilities underway at an estimated rate of 55 hectares a month. These facilities are run by criminal organizations which, with Thai police estimating at least 100,000 trafficked people in these border facilities lured in with the promise of jobs. These elaborate facilities are heavily fortified and contain luxury housing for management as well as serving as social proof for investment scams. Spies impersonate US lawmaker to target trade.

[B]

Groups the Wall Street Journal sources say.

[C]

A campaign tracked to The Chinese backed APT41 orchestrated a campaign in July posing as U.S. representative John Moliner CH, chairman of the House Committee on the Chinese Communist Party. These emails were sent from a non governmental address to trade groups, government agencies and law firms with an attachment that.

[B]

Appeared to be draft legislation and a request for input.

[C]

An investigation by Google's Mandiant found that clicking on the attachments would attempt to install a backdoor. At the time the emails were sent, the US was set to begin trade talks with China in Sweden.

[B]

Gpugate targets IT firms Researchers at Arctic.

[C]

Wolf detailed a new campaign with a new take on malicious advertising dubbed gpugate. This campaign uses paid ads on Google and other search engines, which embed a GitHub commit in the page URL. This contains an altered link that points to the threat actor's infrastructure. This initially points to a 128 megabyte Microsoft software installer, while a GPU gated decryption routine keeps its payload encrypted on systems with without a gpu. This would stymie analysis of the malware on a virtual machine or other sandbox that doesn't typically have GPU resources. The payloads indicate the operators speak Russian and the campaign exclusively targets IT and software development companies in Western Europe.

[B]

And now, thanks to today's episode sponsor Vanta, do you know the status of your compliance controls right now? Like right now, we know that real time visibility is critical for security, but but when it comes to our GRC programs, we rely on point in time checks. But more than 9,000 companies have continuous visibility into their controls with Vanta. Vanta brings automation to evidence collection across over 35 frameworks like SoC2 and ISO 27001. They also centralize key workflows like policies, access reviews and reporting, and helps you get security questionnaires done five times faster with AI.

[C]

Now that's a new way to GRC.

[B]

Get started at vanta.com headlines iCloud calendar used to send phishing emails B computer received word of this scam from a reader who received a message from noreplymail.apple.com advising that their PayPal account was billed and providing a support number to dispute the transaction. Calling the number would lead to scammers attempting to install some hackers helpful software so the customer could log into their PayPal account to initiate a refund aka rip them off. The attackers sent this Message as an iCloud Calendar event to a Microsoft 365 email address. That address was itself a mailing list for a full list of potential victims. While the phishing lure is an extremely tried and true approach, the way it was delivered successfully passed spf, DMARC and DKIM email security checks. Wealthsimple Confirms data breach the Canadian fintech firm said the breach exposed sensitive information on less than 1% of its clients. 30,000 customers had government IDs, social insurance numbers and account numbers exposed. The incident was caused by a compromised third party software provider and was detected on August 30th. All impacted customers were notified as of September 5th. Wealthsimple will offer the industry standard two years of credit and dark web monitoring and and encourage all of its customers to enable 2fa. PACER struggles with MFA rollout PACER is the US government run system used by US courts to access court documents. It's a critical backbone to our legal system. Back in April, PACER announced MFA would become mandatory on accounts that file documents or manage cases, and sent out a notice in August reminding users to enroll by the end of the year, according to reporting by the Register. Some attorneys trying to enroll are seeing long website freezes when logging on and support lines are hammered, leading to multi hour wait times. As a result, Pacer lifted its end of year deadline and said it's switching to a phased MFA rollout. Users should not enroll until prompted by the system. Signal lets you back that chat up the popular encrypted messaging app announced that a beta version of Chat Backups is coming to Android as both a free and paid offering. Users can back up 100 megabytes of chats and the last 45 days of media for free, while 100 GB of media backups will also be available as a paid feature for $1.99 a month. Users receive a 64 character recovery key for chat backups that's generated on device. Signal does not link backups to a user or payment method. Cross platform availability is in the works. This marks Signal's first paid feature. Until now, it only accepted donations Everyone talks about the need for prevention in cybersecurity, but the dirty secret is it's rarely practiced because it introduces productivity friction. Will prevention always be cybersecurity lip service? Or is there a way to achieve meaningful prevention without interrupting the business? That's one of the segments we have on our latest episode of the CISO Series podcast. Look for the episode we all agree that prevention is the best advice we're never going to follow. Wherever you get your podcasts and if you have some thoughts about the news from today or about the show in general, be sure to reach out to [e-mail] we read everything that you send us and we love to hear from you. Reporting for the CISO series, I'm Rich Stroffelino, reminding you to have a super sparkly day.

[A]

Cybersecurity headlines are available every weekday. Head to cisoseries.com for the full stories behind the headlines.