Tokens from 850 GitHub accounts were stolen, and 13,500 branches were planted with a workflow built to dump repository secrets

Since September 15, someone has been taking stolen GitHub tokens and pushing a workflow into every repository those tokens can reach. The workflow does one thing: it prints the repository’s secrets into its own run log. Wiz recovered more than 13,500 of these planted branches, spread across more than 850 compromised accounts. Nobody broke into GitHub here. The tool used stolen keys and features the platform already has.

I maintain open-source projects. My GitHub account is not just a login. It is my name and my release keys in the same place, so I read the Wiz report end to end. The technique did not hold my attention for long, because the technique is not complicated. What stayed with me is the timing. These tokens were probably stolen long before this campaign started spending them.

Take an ordinary repository as an example.…