Gheist campaign plants secret-dumping workflows using stolen GitHub tokens

47 points

1/21/1970

2 days ago

by acossta

Comments

adrianlee_dev

[dead]

2 days ago

quietFerry94

So the scary part with these is that a workflow file committed to a branch can run before anyone reviews the PR, depending on how your triggers are set up. Pull_request_target is still the one that gets people.

2 days ago