Alert: Social Engineering Campaign Targets Open Source Developers via Slack

A high-severity social engineering campaign is targeting open-source developers via Slack impersonation, luring victims to a fraudulent Google Sites link that harvests credentials and prompts installation of a malicious root certificate. On macOS the campaign downloads and executes a binary named 'gapi' from IP 2.26.97.61; on Windows users are prompted to install the fake certificate, enabling encrypted-traffic interception, credential theft, and potential full system compromise. The advisory urges verification of identities, scrutiny of links, rejection of unsolicited root-certificate installs, immediate containment steps (disconnect, remove certificates, rotate credentials) and reporting.