Threat actor Banana Squad exploits GitHub repos in new campaign

Banana Squad, a threat actor first identified in 2023, has launched a new campaign targeting GitHub repositories. The group has created over 60 trojanized repositories masquerading as hacking tools written in Python. These malicious repositories contain hundreds of trojanized Python files that utilize encoding and encryption techniques to hide backdoor code. The campaign primarily uses the domain dieserbenni[.]ru, with a new domain 1312services[.]ru detected recently. The trojanized repositories exploit GitHub's UI feature where long lines of code don't wrap, allowing attackers to hide malicious code off-screen. This sophisticated technique makes visual detection challenging, highlighting the increasing stealth of supply chain attacks on open-source platforms.

• LiteLLM supply chain compromiseCampaign2026-10-22
• Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooksHighVulnerability2026-10-23
• ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software VendorsMalware2026-10-22
• CVE-2026-115419: multiagent-a2a · Unintended disclosure of data element to wrong session in Strands Agents SDK A2A ServerHighVulnerability2026-10-22
• LiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI CredentialsMalware2026-10-21