Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories

Researchers disclosed a credential-theft campaign that compromised two high-profile open-source maintainer accounts, pushing malicious workflows into over 340 repositories. Using the account of Takashi Kitao, author of the 18,400-star game engine pyxel, the attacker pushed a malicious workflow to 27 repositories starting at 13:20 UTC, according to StepSecurity.