GitHub Malware, DNS Hijacking, Ransomware Speed & AI Exploits

This week’s conversation centers on how quickly access forms once something gains traction. It’s no longer about finding a way in. It’s about what’s already spreading, already trusted, and already positioned to reach users at scale.

Across the headlines, that pattern shows up fast. A leaked AI codebase becomes one of the fastest growing repos on GitHub, and within hours attackers use that momentum to deliver malware. Developer workflows become the access path through poisoned dependencies and convincing social engineering. At the network layer, compromised routers quietly redirect traffic and capture credentials without touching endpoints. And once access lands, ransomware crews move from entry to impact in under an hour using prebuilt playbooks.

At the same time, AI is accelerating on both sides. It’s shrinking the gap between vulnerability discovery and exploitation, while over-permissioned agents introduce new ways to inherit access from inside trusted environments.

The common thread is speed backed by trust. Access is no longer a clean moment. It spreads, compounds, and executes before most defenses can respond.

Key Takeaways:

100k stars in a day: Claw-code based on leaked Claude Code smashes GitHub record, Cybernews

https://cybernews.com/tech/claude-code-leak-spawns-fastest-github-repo/

Security News This Week: Hackers Are Posting the Claude Code Leak With Bonus Malware, Wired

https://www.wired.com/story/security-news-this-week-hackers-are-posting-the-claude-code-leak-with-bonus-malware/

• What Matters: A leaked AI codebase didn’t just spread quickly. It created instant legitimacy. Attackers moved just as fast, seeding fake repos and weaponizing that attention to deliver malware. The real shift is how popularity now acts as a proxy for trust, and how quickly that trust becomes an access path.
• What’s Overhyped: The leak is the trigger, not the story. The real play, using shared trust and distribution to gain access, is already well established.

Fake Claude code leak on GitHub pushes Vidar malware, Bitdefender

https://www.bitdefender.com/en-us/blog/hotforsecurity/claude-code-leak-github-vidar-malware

Axios Hack Traced to AI Deepfake Trap, PCMag

https://www.pcmag.com/news/axios-hack-traced-to-ai-deepfake-trap

• What Matters: Attackers are blending technical and human workflows. Fake GitHub repos push malware, while more targeted campaigns use Slack workspaces, staged business processes, and AI-generated personas to convince developers to execute it. The entry point is not a vulnerability. It is normal behavior under time pressure.
• What’s Overhyped: The tooling stands out, but the real driver is behavior. This works because developers move fast, trust what looks legitimate, and skip validation under pressure.

Russian State-Linked APT28 Exploits SOHO Routers in Global DNS Hijacking Campaign, The Hacker News

https://thehackernews.com/2026/04/russian-state-linked-apt28-exploits.html

• What Matters: APT actors are compromising SOHO routers and modifying DNS to intercept traffic. This shifts initial access upstream. Instead of breaching endpoints, attackers control the path and capture credentials in transit. Once in that position, access is passive, persistent, and difficult to detect.
• What’s Overhyped: There’s nothing novel about DNS manipulation. What stands out is how often these devices sit outside visibility. The technique works because the control plane isn’t being monitored.

Akira ransomware group can achieve initial access to data encryption in less than an hour, Cyberscoop

https://cyberscoop.com/akira-ransomware-initial-access-to-encryption-in-hours/

• What Matters: Ransomware groups are reducing time from access to encryption to under an hour by relying on prebuilt playbooks and automation. They are not innovating technically. They are removing friction, skipping validation steps, and executing known paths at speed.
• What’s Overhyped: This isn’t about sophistication. It’s repetition at speed, hitting the same access paths that still haven’t been closed.

Project Glasswing: Securing Critical Software for the AI Era, Anthropic

https://www.anthropic.com/glasswing

• What Matters: AI systems are now capable of identifying and in some cases exploiting vulnerabilities at scale. This compresses the timeline between discovery and weaponization. The bottleneck is no longer expertise. It is response speed across patching, triage, and remediation.
• What’s Overhyped: The breakthrough here isn’t discovery. It’s the gap that follows. Patching, prioritization, and response were already lagging. Faster findings just put more pressure on those same bottlenecks.

'What if the AI agent you just deployed was secretly working against you?': Vertex AI 'double agent' flaw exposes customer data and Google's internal code, TechRadar

https://www.techradar.com/pro/security/what-if-the-ai-agent-you-just-deployed-was-secretly-working-against-you-vertex-ai-double-agent-flaw-exposes-customer-data-and-googles-internal-code

AI Just Hacked One Of The World's Most Secure Operating Systems, Forbes

https://www.forbes.com/sites/amirhusain/2026/04/01/ai-just-hacked-one-of-the-worlds-most-secure-operating-systems/

• What Matters: AI agents with broad permissions can be manipulated into exposing credentials and accessing sensitive systems. This is not direct compromise. It is access inherited from over-permissioned identities already inside the environment.
• What’s Overhyped: Framing this as an “AI problem” misses the point. Overprivileged identities and weak access controls have always been exploitable. This just scales the risk.