Cybersecurity & Data Protection
0
UPVOTE
thehackernews.com

Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories

Cybersecurity researchers have disclosed details of an ongoing credential-theft campaign that has compromised two high-profile open-source maintainer accounts to push a malicious workflow into over 340 repositories. "Using the account of Takashi Kitao, author of the 18,400-star game engine pyxel, the attacker pushed a malicious workflow to 27 repositories starting at 13:20 UTC," StepSecurity
Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories
MB

Maria Bakker

1h ago
0 0

Discussion

Begin the discussion

Begin something meaningful by sharing your ideas.

No comments yet.

Be the first to share your take and keep the conversation moving.

Join the conversation

Log in or sign up to add your comment and participate in the discussion!

Log In Sign Up

UPVOTERS

Community appreciation

See who found this content valuable and showed their support.

No upvotes yet.

Be the first to show your appreciation for this content.

TOPICS

Explore the same topics

Discover more content from the topics this post is mapped to.

darkreading.com
What We Missed: FBI Strikes Back at ShinyHunters

In this video conversation, Dark Reading editors discuss some of the news they didn't get a chance to cover, from the arrest of a suspected ShinyHunters operat…
DR

Dark Reading

5h ago
0
bleepingcomputer.com
Max severity SonicWall SMA1000 flaw now exploited in attacks

Attackers are exploiting a maximum-severity vulnerability in SonicWall SMA1000 appliances (CVE-2026-102255) that was patched on Tuesday, three days ago. [. .. ]
RM

ryan maybe

8h ago
0
thehackernews.com
GoBalance Flaw Lets Attackers Hijack .onion Addresses by Recove…

A bug in GoBalance, a tool many dark-web sites use to stay reachable during attacks, lets anyone work out the secret key that controls a site's . onion address…
TN

The Hacker News

12h ago
0
darkreading.com
'AgentCorruption' Puts AWS Environments At Risk With Single Pro…

A now-patched vulnerability in AWS Bedrock AgentCore could allow an attacker to use one AI chatbot to take over an organization's entire fleet.
DR

Dark Reading

18h ago
0
bleepingcomputer.com
FBI disrupts Chinese hacking tools used to breach critical infr…

The FBI has seized seven domains used by Chinese state-sponsored hackers known as Flax Typhoon to operate two hacking tools, MicroScan and FishHub, used in att…
NightCurator

NightCurator

19h ago
0
schneier.com
How Technology Empowers—and Imperils—Dictators

This essay was written with Seva Gunitsky, and originally appeared in Foreign Affairs. Two weeks after Moscow’s full-scale invasion of Ukraine in March 2…
SS

Schneier on Security

1d ago
0

Keep browsing

Explore more from this topic

Dive into the full feed of curated posts covering Cybersecurity & Data Protection.

Browse Topics

RELATED CONTENT

Continue exploring

Discover more content that aligns with your interests and this post.

thehackernews.com
GoBalance Flaw Lets Attackers Hijack .onion Addresses by Recove…

A bug in GoBalance, a tool many dark-web sites use to stay reachable during attacks, lets anyone work out the secret key that controls a site's . onion address…
TN

The Hacker News

12h ago
0
thehackernews.com
Wazza Phishkit Targets Banking, Government, and Manufacturing A…

Phishing kits are no longer limited to copying a familiar login page and waiting for a victim to enter credentials. Attackers are increasingly building filteri…
TN

The Hacker News

1d ago
0
thehackernews.com
Attackers Hijack .gh, .sl, and .as Registries to Obtain Certifi…

Attackers compromised three country-code top-level domains (ccTLDs) and obtained unauthorized HTTPS certificates for several Google domains, Google said o…
alex but tired

alex but tired

2d ago
0
thehackernews.com
100+ Compromised Websites Use Fake Cloudflare Checks to Deliver…

The Computer Emergency Response Team of Ukraine (CERT-UA) has identified more than 100 compromised websites that have been injected with malicious JavaScript t…
TN

The Hacker News

2d ago
0
thehackernews.com
Fake ChatGPT, Gemini, and Claude Ad Portals Capture Credentials…

Cybersecurity researchers have disclosed details of a "human-operated phishing platform" that impersonates advertising products for artificial intelligence (AI…
Golden Greta

Golden Greta

3d ago
0
thehackernews.com
LibreOffice and OpenOffice Flaws Let Malicious Spreadsheets Run…

A malicious spreadsheet can make LibreOffice and Apache OpenOffice run an attacker's code as soon as the file is opened, security researchers have shown. There…
TN

The Hacker News

3d ago
0

Still curious?

See more related posts

Keep the inspiration flowing with fresh submissions and trending finds from the community.

View Latest