Afternoon Review in IT Security — May 20, 2026

The threat landscape continues to evolve with significant developments across multiple attack vectors today, ranging from targeted financial institution compromises to critical platform vulnerabilities and supply chain threats affecting major software repositories.

Banana RAT Malware Targets Brazilian Banking Customers Through Fraudulent Invoices

A sophisticated malware campaign has emerged targeting customers of 16 Brazilian banks through deceptive invoice documents and fake security update screens. The Banana RAT malware, distributed via these social engineering tactics, is designed to steal sensitive customer data and facilitate QR code fraud schemes. The campaign leverages convincing phishing techniques to trick users into executing malware payloads disguised as legitimate banking communications. Source: Banana RAT Malware in Fake Invoices Hits Customers at 16 Brazilian Banks

Microsoft Releases Mitigations for YellowKey Windows BitLocker Zero-Day

Microsoft has published mitigation strategies addressing YellowKey, a critical Windows BitLocker zero-day vulnerability that could allow attackers to gain unauthorized access to encrypted drives. The vulnerability, tracked under CVE-2026-33825 and CVE-2026-45585, has been associated with malware families including GreenPlasma, RedSun, and UnDefend. Organizations are advised to implement the recommended mitigations immediately to protect systems from potential exploitation. Source: Microsoft shares mitigation for YellowKey Windows zero-day

GitHub Investigates Breach of Internal Repositories by TeamPCP

GitHub is actively investigating a significant security incident involving unauthorized access to approximately 4,000 internal repositories containing private source code. The TeamPCP hacker group has claimed responsibility for the breach, using the TeamPCP Cloud Stealer malware to compromise the platform's internal systems. The investigation is ongoing as GitHub works to assess the scope of exposed information and remediate affected systems. Source: GitHub investigates internal repositories breach claimed by TeamPCP

GitHub Confirms Compromise via Poisoned VS Code Extension

GitHub has confirmed that the platform suffered a compromise originating from an employee device that was infected through a malicious Visual Studio Code extension. The poisoned VS Code extension served as the initial attack vector, enabling threat actors to establish access to GitHub's internal infrastructure. This incident underscores the critical importance of securing development tools and monitoring third-party extensions for tampering. Source: GitHub confirms they were compromised after an employee device involving a poisoned VS Code extension

Today's threat intelligence demonstrates the continued sophistication of attackers targeting both financial institutions and critical software development platforms, with particular emphasis on supply chain vulnerabilities and social engineering tactics that exploit trusted communication channels.