Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories

October 7, 2026 · 12:50 pm 2 sources

Image: The Record

Coverage

Coverage

• FBI, Secret Service add to warnings of FortiBleed credential stealing campaign
  The Record by Recorded Future News · October 7, 2026 12:50
  Users of two types of Fortinet hardware should take steps to limit their exposure to a now-global credential stealing campaign, U.S. federal law enforcement says.

More coverage

• Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories
  The Hacker News · October 9, 2026 19:14
  Cybersecurity researchers have disclosed details of an ongoing credential-theft campaign that has compromised two high-profile open-source maintainer accounts to push a malicious workflow into over 340 repositories. "Using the account of Takashi Kitao, author of the 18,400-star game engine pyxel,…