Attacker Targets 60,000 GitHub Repositories in Credential Theft Campaign

The attacker compromised thousands of developer and bot accounts to inject credential-stealing code directly into GitHub Actions workflows, shell scripts, and npm hooks — trusted components of the software development pipeline. This is a classic supply chain attack: by targeting the build and automation layer rather than production systems directly, the attacker harvested GitHub tokens, cloud credentials, and AI service keys at scale. The incident highlights how overprivileged bot accounts and poorly reviewed CI/CD configurations create a massive attack surface. When credentials stolen from one repository can pivot into AWS or Azure environments, the blast radius extends far beyond source code.