Observed Signal · Oct 27, 2026 · Market Signal · Source: RedTrack · Impact: 5/5
Hacked by CoupDeGrace
The RedTrack blog page has been defaced with multiple posts titled 'Hacked by CoupDeGrace' and a message crediting several hackers. This indicates a security breach of the website.
Track RedTrack Signals & Market Shifts in Real-Time
Polaris7 autonomous intelligence agents track regulatory filings, primary sources, executive changes, and deal flow 24/7. Create your Polaris7 workspace to monitor these entities.
Connected Companies & Entities
1 Entity mappedRelated Market Signals & Shifts
Recent verified developments and strategic activity across this market segment.
GitHub Hack: Data Stolen from ~3,800 Internal Repos
GitHub, owned by Microsoft, confirmed a security breach in which attackers stole data from approximately 3,800 of the company’s internal code repositories. The company said it detected and contained a compromise of an employee device that involved a poisoned Visual Studio Code (VS Code) extension. GitHub reported no evidence so far that customer information stored outside of its internal repositories was impacted, and its investigation remains ongoing. A hacking group called TeamPCP has claimed responsibility and is reportedly selling the stolen data on a cybercrime forum. The incident follows a pattern of supply‑chain attacks against developer tools and extensions, with prior related breaches affecting Trivy, the European Commission, Tanstack, and resulting targeting of other major tech organisations.
Rival hackers evict TeamPCP, deploy worm 'PCPJack'
An unknown hacking group, tracked by SentinelOne as “PCPJack,” has been compromising systems previously breached by the cybercrime group TeamPCP. According to a SentinelOne report, the attackers break into TeamPCP‑compromised environments, remove TeamPCP’s tooling, evict its operators, then deploy self‑propagating code that steals credentials and exfiltrates data. The group appears focused on cloud infrastructure and also scans the public internet for exposed services such as Docker and MongoDB. SentinelOne researcher Alex Delamotte said the motives appear financial — stolen credentials are monetized via resale, initial‑access brokering, or direct extortion — and proposed theories including disgruntled ex‑TeamPCP members, rival operators, or imitators modeling TeamPCP’s tools. The campaign is notable for targeting previously compromised environments and using phishing domains (including password‑manager themed sites) and fake help‑desk pages as part of its activity.
Hackers steal Claude tokens from subscribers via infostealer malware
Anthropic Claude users are facing unauthorized token consumption, with hackers using info-stealer malware to steal active login sessions and bypass passwords and MFA. Independent AI consultant Grant De Swardt saw his Claude Max account consume tokens while idle, and despite disabling connected services, usage continued. Anthropic locked his account, reset sessions, and invalidated tokens issued to Claude Code. Other users reported similar issues, including unauthorized upgrades to paid tiers without consent. Anthropic confirmed the attacker method and advised users to terminate sessions, change passwords, enable MFA, scan for malware, review payment details, and document unusual usage. However, without detailed usage reports, detecting abuse is difficult. The incident highlights growing security and trust concerns for AI subscription services, prompting some users to consider alternatives like Cursor.
Receive all future signals for RedTrack & competitors in your briefing
Never miss material M&A deals, leadership changes, account wins, or product rollouts. Polaris7 monitors 20,000+ primary sources 24/7, delivering verified telemetry directly into your executive briefing.