Mythos social engineering AISI INC-2026-07-28-01

Discussion (13 Comments)Read Original on HackerNews

WhyNotHugo•23 minutes ago

Actual details on the incident: https://github.com/w1b/aisi-mythos-inc-2026-07-28-01-recover...

Both the attacker and the target account are very similar and look fake/bots.

dnnehgf•12 minutes ago

yeah, this being one component of what was being discussed in the aisi writeup here: https://cdn.prod.website-files.com/663bd486c5e4c81588db7a1d/...

summarity•about 1 hour ago

Working with maintainers (on the GitHub side) there’s definitely been a rise of malware dropper attacks against popular OSS repos, though this is particularly brazen - pressure tactics and all.

cpcallen•15 minutes ago

For anyone who, like me, wasn't sure what's going on in the linked, archived PR: this is Mythos attempting to socially engineer a malicious PR during a test run by the UK AI Safety Institute.

AISI has published a report about the incident which was preciously discussed on HN: https://news.ycombinator.com/item?id=49175717

jtakkala•about 1 hour ago

Not going to comment on the PR commentary, but the victim GitHub account is suspicious itself, recent account, a few fresh repos, following 14.5k others, and I count three surnames on the account (the username, plus two in the README history).

ncr100•41 minutes ago

I saw a contribution by this maintainer to another user who ALSO HAS 14.5k followers: https://github.com/yumiaura/myCat/pull/99 "yumiaura" and a preference for "my[APPNAME]" repo naming.

What is this?

Are the histories that Github presents all derived from someone's uploaded git repo .. e.g. can I simply claim to have created a GIT repo in 1970, and the "github commit graph" will dutifully represent this claim in its green-colored activity graph?

jtakkala•28 minutes ago

They're almost certainly not genuine accounts, maybe used for karma farming, phishing, social engineering, future malware distribution?

andai•25 minutes ago

What does this malware do? Who operates it?

ncr100•about 1 hour ago

Wait, who is the robot? Am I getting that right, someone in that thread is AI?

Erem•33 minutes ago

I…I think there are no humans in that thread. Maybe only sinan-can-demir.

mekael•24 minutes ago

I'm 99.9% sure that everyone is AI in that thread.

zezcko•about 1 hour ago

holy shit

gryfft•about 1 hour ago

Yeah, if this is the new normal I might start day drinking at some point in the coming weeks.

Mythos social engineering AISI INC-2026-07-28-01

⚡ Community Insights

Discussion (13 Comments)Read Original on HackerNews