general
Imported story
Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs
Source: The Hacker News · Published · Last checked 14 minutes ago · 1 min read
Read original source ↗ (thehackernews.com)
Publisher excerpt From The Hacker News
An automated campaign is using stolen GitHub tokens to plant workflows that print a repository's secrets into its GitHub Actions logs, which the attackers then download before deleting the runs. The attacks have succeeded in private repositories and GitHub Enterprise environments, according to an analysis by cloud security company Wiz. A GitHub safeguard that pauses
Excerpt only, shown with attribution. This content belongs to the original publisher and has not been independently verified by CyberSecurity.pk.