Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories

Cybersecurity researchers have uncovered a credential theft campaign that has compromised high-profile open-source maintainer accounts. The attackers used these accounts to push a malicious workflow into numerous repositories, with one instance involving the account of Takashi Kitao, author of the pyxel game engine. The malicious workflow was pushed to 27 repositories, starting at a specific time. This campaign has affected over 340 repositories in total. The attackers' goal is to steal credentials. The malicious activity was detected and disclosed by researchers.