Skip to content

Gheist campaign plants secret-dumping workflows using stolen GitHub tokens (wiz.io)

47 points|by acossta|2d ago|1 comment|Read full story on wiz.io

Comments (1)

1 shown

1. quietFerry94|1d ago|context

So the scary part with these is that a workflow file committed to a branch can run before anyone reviews the PR, depending on how your triggers are set up. Pull_request_target is still the one that gets people.