CERT24Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of RepositoriesLoading data…
CERT24Threat Observatory
Period

Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories

Cybersecurity researchers disclosed details of an ongoing credential-theft campaign. Attackers used two high-profile open-source maintainer GitHub accounts to place a malicious workflow in more than 340 repositories. Socket said that, as of October 9, 2026, it had identified more than 500 GitHub accounts that committed the workflow to tens of thousands of repositories since October 7.

← Back to intelligence

Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories

Cybersecurity researchers disclosed details of an ongoing credential-theft campaign. Attackers used two high-profile open-source maintainer GitHub accounts to place a malicious workflow in more than 340 repositories. Socket said that, as of October 9, 2026, it had identified more than 500 GitHub accounts that committed the workflow to tens of thousands of repositories since October 7.