GitHub Supply Chain Attack Exposes Developer Secrets as Malicious Workflows Execute Across 1,806 Repositories

A threat actor is using stolen GitHub credentials to push malicious workflow code into tens of thousands of repositories. The goal is to steal CI secrets and cloud credentials. The campaign began on November 10, 2026. Researchers say 4,837 compromised accounts opened probe pull requests in 61,764 repositories. At least 1,806 repositories ran the... Weiterlesen: GitHub Supply Chain Attack Exposes Developer Secrets as Malicious Wor…