Malicious GitHub Actions Workflows Found in Numerous Repositories

Cybersecurity researchers have uncovered a credential-theft campaign that compromised over 500 GitHub accounts. This incident involved injecting malicious workflows into tens of thousands of repositories between 21:10 and 21:26 UTC on October 9, 2026. The widespread nature of this attack poses a significant security risk for developers and projects hosted on GitHub.