Cyber Security News

Hacking Editorial Brief: May 21, 2026

GitHub Breach and Supply Chain Risk

Microsoft-owned GitHub disclosed a significant security incident late Tuesday in which attackers compromised approximately 3,800 internal repositories. The breach originated from a malicious Visual Studio Code extension that provided initial access to the platform. The stolen repositories are now reportedly being offered for sale on underground markets. This incident underscores the persistent risk of supply chain attacks through developer tooling, where trusted platforms remain high-value targets for threat actors seeking proprietary code, credentials, and intellectual property.

Active Zero-Day Exploitation Campaigns

A threat actor operating under the moniker Nightmare-Eclipse has released six Windows zero-day exploits—including tools dubbed YellowKey and MiniPlasma—in what appears to be a vendetta campaign against Microsoft. Separately, a critical heap buffer overflow vulnerability in F5 NGINX (CVE-2026-42945) has moved from public disclosure to active exploitation within just three days, with attackers targeting internet-exposed servers. The rapid weaponization timeline highlights the compressed window organizations have to patch critical infrastructure flaws before exploitation begins at scale.

Credential Theft and Financial Crime Operations

Microsoft has warned that the threat group Storm-2949 is actively abusing password reset features across Microsoft services to harvest user credentials and gain unauthorized account access. In South Korea, authorities arrested members of an international hacking group that used SIM cloning techniques to extort approximately 48.4 billion won from wealthy individuals, including BTS members and business executives. Ukrainian law enforcement is also investigating a teenage suspect linked to a cyber theft operation targeting California-based online shoppers, following intelligence sharing from U.S. authorities.

Sources: Chosun · TechRadar · The Record · BankInfoSecurity · Security Affairs · CyberPress · Barracuda