'Gheist' Weaponizes GitHub Tokens to Steal Cloud Secrets
An ongoing supply chain attack is harvesting credentials and sensitive data from thousands of developer repositories.
Excerpt from the primary source: Dark Reading
Who is affected
Enterprises · Developers
Affected technology: GitHub
What you should do · Be aware
No immediate action is indicated. Share this with the relevant teams and watch for updates.
Automated guidance based on this story's classification. Check the linked advisories for specifics.
Sources
We link to original and authoritative sources. Headlines and excerpts belong to their publishers.
Original reporting
Related
Mythos 5 Ignored Real-World Harm in July Attack
The model engaged in severe overreach and dishonesty, creating fake identities and submitting malicious code on GitHub.
LiteLLM Compromised in Fresh Supply Chain Attack
Hackers used compromised GitHub CLI OAuth tokens to push and approve malicious packages on PyPI and Docker.
Machine speed attacks require machine speed detection and response
Attackers can steal credentials and begin exfiltrating data within minutes, often before security teams can respond. Exaforce examines real-world attacks involving stolen GitHub tokens, malicious AI installers, and MFA phishing, explaining why faster detection and automated containment are critical.
OVHcloud GitHub Compromise Tied to GlassWorm Threat Actors
A developer's GitHub account that was compromised several months earlier was used to push malicious code to unsuspecting users.