Fake security tools on GitHub push backdoors and infostealers

Repositories posing as security utilities are being used to infect the people most likely to download them: researchers and defenders.

GitHubInfostealer

Updated 9 Nov 2026

Repositories posing as security utilities are being used to infect the people most likely to download them: researchers and defenders.

What to do

Keep an eye on follow-up reporting and brief your team.

Original reporting: Cybersecurity News roundup

Original reporting: Cybersecurity News roundup

Discussion

0 comments

Get the Weekly Wire

The week's exploited vulnerabilities and breaches, in one email.

More Threats

HighThreats5 Nov 2026Members

Backdoor found inside Control Web Panel's own web server

Researchers at QiAnXin's XLab found the implant in the server that runs CWP, a free panel widely used to manage Linux hosting boxes.

Linux hostingBackdoor

The Hacker News

MediumThreats5 Nov 2026

Remote hacks warm supermarket fridges; French blood bank site hit

Retailers in several European countries reported refrigeration systems tampered with remotely. A separate attack on a French blood bank site did not affect blood products.

OTCritical infrastructure

SecurityWeek

HighThreats3 Nov 2026

Backdoor turned 1.3 million Android TV boxes into a criminal botnet

Manufacturer Videostrong planted the backdoor in set-top boxes and sold criminals access to the resulting network.

BotnetAndroidIoT

Malwarebytes Labs