Starting Tuesday, an attacker used stolen credentials for 4,837 GitHub accounts to plant a secret stealer in repositories those accounts could write to, according to Aikido Security, a security software company.
The stealer is built to take the secrets and cloud credentials that a repository’s CI workflows can reach. It ran in at least 1,806 repositories, where the attacker has likely collected
from The Hacker News https://ift.tt/QxZKA1S
https://ift.tt/eTU4AVk
