Search
Starting November 10, threat actors leveraged stolen GitHub account credentials to push malicious CI workflows to tens of thousands of code repositories. During the incident, 4,837 compromised accounts opened probing pull requests across 61,764 repositories, and approximately 6,500 repositories (11%) executed the malicious payload, resulting in credential leakage. The malware exfiltrated runner secrets including GitHub Actions secrets, GITHUB_TOKEN, AWS/GCP/Azure credentials, and AI provider API keys, and infiltrated at least one Packagist package and one Go module through an automated publishing mechanism. This attack overlaps with the October GhostAction campaign, though it remains unconfirmed whether the same threat actor was responsible.
-
C114 Communication Network -
Communication Home
