GitHub Developers Hit in Complex Supply Chain Cyberattack

An unidentified threat group executed a sophisticated software supply-chain campaign against the Top.gg GitHub organization and open-source Python packages by hijacking developer accounts (via stolen cookies), pushing verified malicious commits, creating a fake PyPI mirror, and publishing tainted packages (notably impacting Colorama). The delivered malware uses obfuscation, persistence mechanisms, and data-stealing capabilities to exfiltrate browser cookies, autofill data, credentials, Discord tokens, cryptocurrency wallets, Telegram session data, and Instagram information; abused domains were taken down but the threat is considered active.