Loading story…
Wiz CIRT reported a coordinated campaign in which threat actors used compromised GitHub Personal Access Tokens (PATs) to reconnoiter and exfiltrate private repositories from multiple organizations. Activity began with repository enumeration on May 15, followed by low-volume clone validation between May 29 and May 31, before highly parallel cloning on June 1. The attackers used 102 IP addresses in AWS's ca-central-1 region and the git/2.43.0 user agent, cloning as many as thousands of repositories from individual victims.
The origin of the stolen PATs remains unknown. Wiz found no evidence that the tokens had been exposed in source code or cloud resources, while endpoint credential theft remains a possible access vector. Organizations should revoke and rotate affected PATs and credentials, identify every repository cloned with compromised accounts, assess exposed secrets, and hunt across cloud and SaaS environments for follow-on abuse of harvested access material.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
From approximately 09:14 to 14:55 UTC, the actors used 102 AWS ca-central-1 IP addresses and the git/2.43.0 user agent to highly parallelize cloning of private repositories. The campaign exfiltrated up to thousands of repositories per affected organization.
A threat actor used compromised GitHub Personal Access Tokens to query the /repositories/{id}/readme API endpoint from 13.221.167.217, an EC2 IP in AWS us-east-1. The activity generated GitHub api.request events and used a Chrome 125 user agent.
Between May 29 and May 31, compromised PATs performed a limited number of git.clone operations from 107.174.201.183, attributed to HostPapa in the United States. The near-simultaneous activity across victims and git/2.25.1 user agent indicated automated validation.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 104 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that the `prt-scan` campaign abused misconfigured GitHub Actions workflows using the `pull_request_target` trigger to run attacker-controlled code from forked pull requests in privileged CI contexts. The actor used at least six GitHub accounts to submit more than 500 malicious pull requests across six waves, disguising many as routine CI updates and tailoring payloads to Python, Node.js, Go, Rust, and GitHub Actions repositories. Wiz said the operation evolved from simple bash payloads into AI-assisted, repository-aware implants designed to steal `GITHUB_TOKEN` values, enumerate secrets, probe cloud metadata services, and exfiltrate credentials through workflow logs and pull request comments. The campaign succeeded often enough to cause real supply-chain impact despite an estimated success rate below 10%. Wiz confirmed compromise of the npm packages **`@codfish/eslint-config`** and **`@codfish/actions`** across 106 versions, and verified theft of AWS keys, Cloudflare API tokens, and Netlify authentication tokens. High-profile projects including Sentry, OpenSearch, IPFS, NixOS, Jina AI, and recharts reportedly blocked the attempts through contributor approval gates and workflow restrictions. The activity follows earlier warnings from Sysdig that insecure use of `pull_request_target` in prominent repositories such as MITRE, Splunk, and Spotipy could expose secrets and high-privilege `GITHUB_TOKEN` permissions, underscoring that unsafe GitHub Actions defaults remain an active software supply-chain risk.
Jun 29, 2026
Datadog Security Research reported sustained campaigns abusing GitHub’s public and authenticated APIs to enumerate enterprise organizations, repositories, and users while blending into normal developer traffic. The activity relied on automated scraping through endpoints including `/graphql`, dormant “ghost” GitHub accounts, and in some cases compromised OAuth tokens or personal access tokens. Researchers identified more than 50 ghost accounts since October 2025, along with recurring user agents such as `GitHub-Company-Scraper`, `GitHub-Scraper-Tool/1.0`, `GitHubAnalytics/1.5`, `GitHub-Commit-Fetcher/1.3`, `GitHub-Commit-Fetcher/1.4`, and `GitHub-Event-Fetcher/2.2`, with some infrastructure linked to 3xK Tech. While much of the traffic queried public data and appeared benign in isolation, researchers said the aggregate behavior amounted to coordinated reconnaissance that could support later theft of secrets, repository cloning, or broader intrusion activity. In a more serious observed case, a tool identified as `repo-dumper` successfully cloned or accessed a private repository, with GitHub audit logs showing `git.clone` and `api.request` events against private paths. Defenders were urged to baseline GitHub audit activity and hunt for unusual user agents, actor names, token types, source ASNs, and successful access to private resources, while also enforcing MFA, conducting access reviews, enabling audit log streaming, and using repository secret scanning.
Jul 11, 2026
Researchers reported a large-scale software supply chain campaign that abused compromised GitHub repositories and malicious GitHub Actions workflows to turn GitHub-hosted Ubuntu runners into disposable scanning and exploitation infrastructure. The activity was first linked to ten Packagist PHP packages associated with the legitimate developer account **dinushchathurya**, but the PHP packages themselves were benign; the malicious execution path came from injected workflow files committed to the repositories. Investigators identified 583 malicious workflow files in the initial cluster, all tied by code reuse and a shared DNSHook callback, with payloads downloaded from `43[.]228[.]157[.]68`. The workflows scanned internet-facing systems and attempted to exploit **cPanel** and **WHM** authentication bypass flaw `CVE-2026-41940`, then exfiltrated harvested credentials and configuration data. Stolen material reportedly included cloud keys, source-control tokens, API credentials, database secrets, and SSH-related data from exposed servers. Researchers said the campaign was far broader than one maintainer account, finding about **6,100** linked workflow files and **15,000 to 16,000** additional files matching related indicators across GitHub, and warned the operation likely remains active through forks, mirrors, cached snapshots, stolen credentials, and surviving attacker infrastructure.
Jul 24, 2026