Gheist campaign has compromised over 850 GitHub accounts since September 15, 2026, injecting malicious workflows named sync-check into repositories to exfiltrate CI/CD secrets. The automated attack plants workflows that base32-encode repository secrets to bypass GitHub's masking, with tool variants evolving to extract credentials from self-hosted runners, cloud providers, and Kubernetes environments. GitHub's approval hold blocks execution in public repositories, but private repositories and enterprise environments remain vulnerable to active, ongoing exploitation.
Attackers compromised LiteLLM's GitHub organization and injected credential-stealing workflows into the BerriAI/litellm repository on October 10 and 12, 2026. The malicious workflows exfiltrated CI/CD secrets including GitHub tokens, API keys for OpenAI, Anthropic, AWS Bedrock, and other services. Eleven days later, on October 21, the attacker used stolen maintainer privileges to bypass branch protections and release seven malicious PyPI packages (litellm==1.107.0) and container images. Initial access stemmed from an Agent Platform master key left publicly committed on May 27 and never revoked.
OVHcloud's GitHub CLI repository was compromised on October 19, 2026, when an attacker accessed a developer's GitHub account and injected a malicious binary into releases v0.11.0–v0.15.0. The malware was designed to steal sensitive credentials from users' disks. The compromise was detected and blocked within 94 minutes. Users of affected versions were advised to delete or update immediately and rotate stored credentials.
GhostAction campaign returned with an expanded credential-theft operation, injecting malicious GitHub Actions workflows into 790 repositories as of October 9, 2026. Attackers exploited compromised maintainer accounts to push security-themed workflows that steal CI/CD secrets and search repository history for credentials including AWS, GitHub, GitLab tokens, and AI-service keys. The new variant exfiltrates data to an attacker-controlled IP (193.32.204.199) and can expose credentials committed long ago.
The GhostAction malicious workflow campaign has compromised 772 public repositories across 373 GitHub users and organizations between August 31 and September 30, 2026. Attackers injected malicious GitHub Actions workflows disguised as security checks to steal SSH keys, cloud credentials, Azure/AWS access keys, and GitHub tokens. Researchers confirmed successful exfiltration of 3,325+ secrets, with 26 secrets confirmed stolen from 13 repositories. Only 16% of affected repositories showed effective remediation by early October.
Security researchers disclosed a Cryptographic Context Injection (CCI) vulnerability in GitHub Copilot CLI enabling attackers to steal developer secrets through encrypted prompt injection via attacker-controlled webpages. Demonstrated extraction of sensitive files like `.env.prod` in 28 seconds when autopilot mode is enabled. Adversa AI reported the issue to GitHub's bug bounty program on September 17, 2026; GitHub acknowledged the behavior but declined to classify it as a vulnerability or grant bounty eligibility.
GitLab disclosed CVE-2026-90970, a critical remote code execution vulnerability in self-hosted AI Gateway affecting versions 18.1.6 through 19.4.0. An authenticated attacker with Duo Agent Platform access can craft a malicious flow configuration to escape the prompt template sandbox and execute arbitrary commands on the AI Gateway host. CVSS score 9.9. GitLab released patched versions 19.2.4, 19.3.2, and 19.4.1 and recommends immediate upgrade for self-hosted deployments; cloud-hosted gateways are already patched.
Security researchers identified 543,699 active credentials exposed in public GitHub repositories, many remaining valid for years despite being publicly accessible since 2009. The study reveals that GitHub's push protection controls, introduced in February 2024, prevent some leaks but fail to block over half of credential types including database strings, private keys, and Google API keys. Analysis shows issuer-side revocation is the primary factor in limiting exposure; credential survival varies widely depending on the service, with 88% of PostgreSQL URIs and 54% of Google Cloud keys remaining live.
Threat actors leveraging the TanStack npm supply chain compromise obtained a GitHub OAuth token from credential-harvesting malware (Shai Hulud) and used it to clone approximately 170 CrowdSec repositories in May. The breach exposed private source code, AWS credentials, and email addresses of 83 users and 51 investors. The compromised token belonged to a departing employee whose account remained active in CrowdSec's GitHub organization.
CVE-2026-3854, a critical remote code execution vulnerability in GitHub's Git push processing pipeline, was disclosed after researcher Saif Ghani received a $100,000 bounty on July 22, 2026. An unauthenticated attacker could execute arbitrary commands on GitHub backend infrastructure via a specially crafted repository URL during Git operations. The flaw allowed improper handling of repository data without sanitization, potentially enabling access to repository secrets, source code modification, and supply-chain attack vectors. GitHub deployed mitigations through coordinated disclosure.
CVE-2026-86492 in JetBrains YouTrack (before 2026.2.18634) allows cross-tenant theft of GitHub App installation tokens through a shared token cache vulnerability. The flaw has a CVSS score of 8.5, requiring only low privileges and network access. Affected GitHub users should verify YouTrack deployments are patched and review token access logs.
A GitHub Actions injection vulnerability in Snowflake's public snowflake-connector-net repository allowed unauthenticated attackers to execute arbitrary commands on GitHub-hosted runners and steal internal credentials. The flaw exploited unsafe expression interpolation in a workflow triggered by issue creation, bypassing security gates. Active for five days (June 18–23, 2026), it was discovered by Wiz Red Agent and remediated immediately upon disclosure.
GitHub released a security patch for the actions/checkout action that prevents the 'pwn request' vulnerability pattern in GitHub Actions CI/CD workflows. The patch, initially released in actions/checkout v7 on June 18, was backported to versions 2-6 on July 20, 2026. This addresses an attack vector where privileged pull_request_target workflows could execute untrusted fork code. The enforcement activates automatically for floating-tag users; SHA-pinned workflows must upgrade manually.
A threat actor has deployed Operation Muck and Load, a network of over 200 malicious GitHub repositories across 190 accounts designed to distribute Windows malware. The campaign uses a deceptive Go module masquerading as a DNS scanning tool to load PowerShell code that fetches and executes malware including spyware, trojans, infostealers, and cryptominers. Since January 2026, the actor has published over 1,200 versions of the package, of which 700 are malicious.
Researchers at Noma Labs disclosed GitLost, a critical prompt injection vulnerability in GitHub's Agentic Workflows that allows unauthenticated attackers to exfiltrate sensitive data from private repositories. The flaw exploits insufficient trust boundary separation between system instructions and user-controlled input in GitHub Issues. Attackers can craft malicious issue content to trick the AI agent into executing unauthorized commands and leaking private repository data as public comments.
Researchers at Novee Security disclosed Cordyceps, a class of CI/CD vulnerabilities in GitHub Actions workflows affecting 300+ repositories. The attack exploits insecure workflow compositions using pull_request_target and workflow_run triggers that grant access to repository secrets and write tokens. Attackers can inject commands or code through pull requests to compromise projects from Microsoft, Google, Apache, Cloudflare, and the Python Software Foundation. The vulnerability is composition-based rather than file-level, allowing exploits to bypass traditional security scanners.
A pseudonymous researcher published a GitHub repository called 'Exploitarium' containing over 30 proof-of-concept exploits for undisclosed zero-day vulnerabilities in open-source projects including Libssh2, FFmpeg, Gitea, MyBB, PHP, and others, without coordinating with maintainers. At least 12 exploits have been assigned CVE identifiers, with CVE-2026-55200 (libssh2 pre-auth RCE, CVSS 9.2) confirmed under active exploitation. The researcher justified the public disclosure approach as educational but acknowledged it enables malicious use.
Researchers discovered multiple trojanized proof-of-concept exploits on GitHub delivering ChocoPoC, a Python-based remote access trojan targeting cybersecurity researchers. The malware is embedded via malicious Python packages ('frint' and 'skytext') listed as dependencies that are automatically fetched from PyPI upon cloning the malicious repositories. When executed, the compiled native extension decrypts and runs embedded Python code to steal data and execute commands.
Mozilla's 0DIN team disclosed a proof-of-concept attack demonstrating how AI coding agents like Anthropic's Claude Code can be exploited via seemingly clean GitHub repositories. The technique uses a three-step indirection chain—a configured package that triggers an initialization command, which fetches and executes attacker-supplied code from a DNS record—to gain shell access without leaving malicious code in the repository itself. No active exploitation has been reported.
CVE-2026-50519, a medium-severity vulnerability in GitHub Copilot Chat version 1.0.0, allows unauthorized information disclosure through an insecure default resource initialization. The flaw requires user interaction and has a CVSS score of 6.5. Microsoft has published an advisory and released an official patch; no active exploits have been reported.
A malware distribution campaign has weaponized fake GitHub accounts and repositories with inflated star counts to build social proof for a Rust-based cryptocurrency clipboard hijacker targeting traders and gamblers. The actors created bogus repositories, used Ghost Networks of fake accounts across multiple platforms, and coordinated AI-narrated YouTube videos and VirusTotal vote manipulation to distribute malicious 'trading tools' and 'crypto sniper bots' that swap victim wallet addresses for attacker-controlled ones. The campaign demonstrates sophisticated reputation spoofing tactics that could be repurposed for deploying more damaging payloads.
GitBait, a long-running serverless phishing campaign, has abused GitHub Pages to host fake banking pages targeting at least 12 Mexican financial institutions over roughly three years. Researchers identified over 100 GitHub-hosted domains involved, with attackers using a modular phishing kit and SheetBest to funnel stolen credentials while relying on GitHub's trusted infrastructure to evade blocklists. GitHub has been notified of all identified domains.
Microsoft disabled dozens of GitHub repositories after discovering password-stealing malware injected into open-source projects. The compromised projects, primarily related to Azure and AI development tools, exposed user credentials. Attackers distributed the malware to steal developer passwords and sensitive information. Microsoft confirmed the incident and restored some repositories after review while others remained offline. This represents a supply-chain attack targeting widely used open-source projects.
Microsoft Threat Intelligence identified a prompt injection vulnerability in Anthropic's Claude Code GitHub Action that exposed CI/CD workflow secrets. The Read tool lacked proper sandboxing, allowing access to /proc/self/environ and potentially leaking ANTHROPIC_API_KEY and other credentials. Anthropic released version 2.1.128 on June 5, 2026, blocking access to sensitive /proc files. Organizations using Claude Code Action with untrusted GitHub content (issues, pull requests, comments) and secret access should patch immediately.
CVE-2026-48501 is a critical vulnerability in GitHub CLI (gh) versions prior to 2.93.0. Improper host normalization logic in the shared HTTP client causes the CLI to attach users' GitHub OAuth tokens to requests to external hosts including tuf-repo.github.com, sigstore.dev, and Azure Blob Storage. Attackers controlling these hosts can intercept the Authorization header and gain full account access, potentially compromising repositories, CI/CD workflows, and API actions.
A critical vulnerability in Visual Studio Code's webview implementation allows attackers to steal GitHub OAuth tokens with full repository access via a single malicious link. Researcher Ammar Askar disclosed a complete exploit chain on June 2, 2026, demonstrating token exfiltration through malicious .ipynb files and synthetic keyboard events that trigger silent extension installation. The attack affects both github.dev and desktop VS Code, with proof-of-concept code publicly released.
CISA warned of two recent supply-chain compromises targeting GitHub. The Megalodon attack on May 18 involved malicious GitHub Action workflows injected into over 5,500 open-source repositories with weak branch protection, stealing cloud credentials, API tokens, SSH keys, and other secrets. A second attack involved compromise of a GitHub employee's device through a poisoned Nx Console Visual Studio Code extension (CVE-2026-48027) published May 19.
OX Security researchers discovered a malicious npm package named mouse5212-super-formatter acting as an infostealer that exfiltrates files from victim machines by routing stolen data through GitHub infrastructure. The threat actor hardcoded their own private GitHub token directly into the package, inadvertently leaking it and allowing researchers to identify and investigate the campaign. The package was reported and removed following disclosure. This incident represents an active supply-chain attack that abuses GitHub as a command-and-control or exfiltration endpoint, a growing pattern in malicious open-source package campaigns. Organizations using npm dependencies should audit their package inventories and monitor for unexpected GitHub API traffic originating from build or runtime environments.
A security researcher was banned from GitHub after publishing zero-day Windows exploit code on the platform, reportedly in retaliation for grievances against Microsoft. The researcher claims Microsoft's actions ruined their life, and at least one security expert has characterized the GitHub account ban as vindictive. The researcher has threatened further retaliatory action, specifying a date of July 14. The incident highlights the use of GitHub as a vehicle for publishing unpatched, live exploit code targeting Windows systems, and raises concerns about the potential for continued weaponized disclosures. GitHub's enforcement action removed the content, but the underlying zero-days and the researcher's stated intent to continue warrant monitoring.
GitHub is investigating a breach of its internal repositories disclosed on May 20, 2026. According to GitHub's confirmation reported in the press, a malicious Visual Studio Code extension compromised an employee's device, giving the attacker access to roughly 3,800 internal GitHub repositories containing private source code. The threat group TeamPCP has publicly claimed responsibility for the intrusion, asserting access to approximately 4,000 repositories. GitHub has not indicated that customer-facing production systems or end-user data were affected. The incident underscores the supply-chain risk posed by trojanized IDE extensions on developer workstations with privileged code access.