Credential‑Stealing GitHub Actions Workflows Found in Tens of Thousands of Repositories

Cybersecurity researchers disclosed on The Hacker News that a coordinated credential‑theft operation has been embedding malicious GitHub Actions workflows across a wide swath of public repositories, with the activity first observed at 13:20 UTC on a recent Tuesday.

The attackers gained control of two high‑profile open‑source maintainer accounts, including that of Takashi Kitao, the creator of the 18,400‑star game engine Pyxel. Using Kitao’s credentials, a malicious workflow was pushed to 27 repositories, and the same technique was later replicated to compromise a total of more than 340 repositories worldwide.

By exploiting the automation capabilities of GitHub Actions, the malicious code can harvest stored secrets such as API keys, tokens and passwords, then exfiltrate them to external servers. Australian developers and organisations that rely on GitHub for CI/CD pipelines are particularly vulnerable if they have not implemented strict permission controls or secret‑scanning tools.

Experts advise immediate review of all workflow files, revocation of any exposed tokens, and adoption of least‑privilege principles for service accounts. Training in secure DevOps practices and certifications such as CompTIA Security+ can help mitigate these risks; Wepro Technology in Darwin offers courses that cover these essential security concepts for IT professionals and students.

The incident underscores the growing threat landscape targeting software supply chains. Australian IT teams are urged to stay vigilant, regularly audit their CI/CD configurations, and keep abreast of emerging threats to protect both corporate and open‑source ecosystems.