Cybersecurity News
Filters
Filtered by tag: github × Clear
Hackers Hijack 790 GitHub Repositories to Steal Cloud Credentials and AI API Keys
Matched: Claude, OpenAI
A campaign called GhostAction has compromised at least 790 GitHub repositories by injecting malicious Actions workflows into trusted developer accounts. The workflows scan repository files and Git history for credentials including AWS keys and tokens for OpenAI, Anthropic, GitHub, and others, then exfiltrate findings to attacker-controlled infrastructure. Removing the workflow is insufficient; affected teams must revoke tokens and rotate all secrets the workflow could have accessed.
Lessons Learned from CISA’s Recent GitHub Leak
CISA released a postmortem after a contractor accidentally exposed dozens of internal credentials, including AWS GovCloud keys, in a public GitHub repository for nearly six months. The leak went undetected until KrebsOnSecurity notified the agency. Security experts say the incident highlights critical gaps in credential monitoring and third-party contractor oversight that all security teams should learn from.