Compromised GitHub accounts push CI secret stealer to tens of thousands of repositories

Starting November 10, a threat actor used compromised GitHub credentials to push a malicious workflow payload into tens of thousands of repositories, exposing GitHub Actions secrets, cloud credentials, and runtime tokens. The payload also proliferated into at least one Packagist package and one Golang package through automated publishing triggers. Researchers observed crossover in impacted accounts with a previous October threat wave, though infrastructure and tradecraft differed. Open article →