Grade One Press

Technology reporting you can check

News · Security & privacy

Malicious workflows planted in 500 GitHub repositories to harvest cloud keys

An automated supply chain campaign injected continuous integration configurations across open repositories to extract cloud infrastructure tokens.

Grade One Newsroom · 1 min read

Sources: 1 · top grade 2How evidence is graded

malicious workflows planted in 500 GitHub repositories

Grade 2 · Published method

Source: Socket Security Research

What changed
Security researchers identified an active campaign injecting malicious GitHub Actions workflows across more than 500 public repositories to extract cloud secrets.
Who it affects
Public software repositories on GitHub running automated continuous integration pipelines with embedded cloud credentials.
What it does not tell you
The disclosure does not determine how many harvested credentials remained valid or whether production cloud infrastructure was breached.

The full story Check the source

Security researchers disclosed an active continuous integration supply chain campaign on 10 October that injected malicious workflow files into more than 500 GitHub repositories [1].

The campaign operates by submitting automated pull requests or pushing commits containing hidden continuous integration configurations [1]. When executed by GitHub Actions runners, the embedded script scans the repository's git commit history and environment variables before exfiltrating discovered cloud credentials to external server endpoints [1].

Targeted secrets include Amazon Web Services access keys, Google Cloud tokens, and automated deployment credentials stored in repository configuration files [1]. Socket Security noted that the attackers attempted to disguise the workflow activities as routine dependency updates [1].

What it measures

The findings count public software repositories on GitHub where researchers confirmed the presence of the specific automated extraction payload as of 9 October 2026 [1]. They measure identified scanning attempts across open development projects [1].

What it does not tell you

The research report does not state how many of the harvested credential pairs were active with administrative cloud permissions when extracted [1]. Nor does it establish whether attackers gained unauthorized access to production infrastructure before project maintainers revoked the exposed keys [1].

Sources and their grades

  1. Socket Security Research, Credential-Stealing GitHub Actions Workflows Planted in Repositories. Read 11 October 2026. Grade 2 · Published method Security research investigation report with published Indicators of Compromise and payload telemetry.

A grade says how much weight a source will take, from 1 (a body that can compel an answer and has nothing to sell) to 5 (somebody describing what they sell, or themselves). The standard sets out what each grade may be used for.

Filed under CI/CD Cloud Developers GitHub Security

Comments

Commenting needs an account, made with nothing but an email address. A first comment is read before it appears.

More news

See all