Wiz says stolen GitHub tokens let attackers dump secrets through Actions logs
Wiz says it recovered more than 13,500 planted branches from more than 850 compromised accounts; GitHub's approval hold stopped observed public-repository runs, not private ones.
By RuntimeWire Staff · Published
Primary source: Hacker News
Why it matters
Gheist shows how a stolen repository token can turn a trusted CI workflow into a secret-extraction path, with GitHub's public-repository approval hold leaving private repositories outside that specific protection.
Wiz's report describes a campaign tracked since September 15th that used compromised GitHub tokens to plant workflows designed to print repository secrets into GitHub Actions logs, then retrieve and delete those logs.…
When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.