Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories
- ID
- 33832
- Status
- new
- Published
- 10 Oct 2026, 3:14 AM
- Fetched
- 10 Oct 2026, 5:40 AM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/10/credential-stealing-github-actions.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Excerpt
Cybersecurity researchers have disclosed details of an ongoing credential-theft campaign that has compromised two high-profile open-source maintainer accounts to push a malicious workflow into over 340 repositories. "Using the account of Takashi Kitao, author of the 18,400-star game engine pyxel, the attacker pushed a malicious workflow to 27 repositories starting at 13:20 UTC," StepSecurity
Summary
No summary yet. It will appear after the daemon summarizes this item.