Cybersecurity researchers have identified a major credential-theft campaign targeting GitHub repositories. Attackers compromised two high-profile open-source maintainer accounts and injected malicious workflows into over 340 repositories. The first attack used the account of Takashi Kitao, creator of the pyxel game engine, to push malicious code to 27 repositories. Hours later, Henry Wu’s account was exploited to distribute the same workflow to 318 repositories within a 16-minute window. Since early October 2026, security researchers have discovered more than 500 compromised GitHub accounts that have distributed the malicious workflow to tens of thousands of repositories.
The attack, attributed to the GhostAction campaign, uses workflows disguised as security audits to steal sensitive credentials including AWS keys, API tokens from cloud and artificial intelligence providers, and authentication tokens from various development platforms. The malicious code scans both active repositories and their complete git history to extract secrets, then transmits the stolen data to attacker-controlled servers. Developers are urged to check their repositories for these malicious workflows since late August 2026, revoke compromised credentials, and delete the malicious files from all branches, particularly in forked repositories where the threat persists.
Source: Read the full story at The Hacker News
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
