Credential Theft and Malicious Workflows: What to Watch For
GitHub’s security team is tracking a recurring attack pattern that starts with stolen user credentials and ends with malicious code running inside repositories. The threat actors behind these campaigns typically obtain a user’s personal access token (PAT), often via infostealer malware like RedLine Stealer, and then use that token to add malicious Actions workflow files to any repositories the compromised account can access.
In some cases, attackers try to hide their tracks by setting the commit author to dependabot[bot] to make the change look legitimate. Another observed variant injects immediately-invoked JavaScript directly into existing files in the affected repositories. In both scenarios, the payload is designed to harvest repository secrets and exfiltrate them to an attacker-controlled endpoint.
Stolen PATs are not the only entry point. Compromised accounts and hijacked GitHub sessions can enable the same abuse, and all three often trace back to malware running on the user’s machine.
Reviewing Changes with Compromise in Mind
Repository owners—including those managing private repositories—should treat unexpected pull requests and commits with extra scrutiny. Pay particular attention to newly added Actions workflow files and any unanticipated modifications to JavaScript files, including third-party scripts bundled with the project. Attackers frequently rely on these file types because they can execute code during CI runs or in a browser context.
If you suspect a repository has been compromised, assume every secret it uses is exposed. Rotate those secrets both in GitHub settings and anywhere else they are used, such as SSH credentials or external services.
For ongoing hardening, GitHub points to a few key resources:
Teams that serve JavaScript to end users should also consider adding the integrity attribute to script tags, a subresource integrity measure that prevents tampered content from executing.
Securing a Suspected Account Takeover
If you believe your GitHub account itself has been compromised, act quickly to limit the damage. GitHub recommends the following steps:
- Review your personal access tokens, revoking any you no longer recognize or need.
- Change your GitHub password.
- Reset your two-factor recovery codes so old codes are invalidated.
- Review and secure your account with additional measures.
GitHub states it continuously monitors for compromised account activity and will disrupt it when identified. Developers can reduce their exposure by protecting credentials such as PATs and by carefully reviewing Actions workflow and JavaScript changes before merging. Questions or reports can be directed to GitHub Support.
