Fake Linux leader using Slack to con devs into giving up their secrets

An attacker impersonated a Linux Foundation community leader in Slack to send a Google Sites phishing link that mimicked Google Workspace sign-in; victims were prompted to enter credentials and install a fake root certificate (malware) that enables interception of encrypted traffic, and macOS victims were directed to download and execute a binary (gapi) from IP 2.26.97.61. The campaign specifically targeted open-source projects (TODO, CNCF), poses a risk of credential theft and full system compromise, and follows other recent supply-chain/social-engineering attacks against developers.