News
Stolen GitHub Tokens Used in Large‑Scale Abuse Campaign
Security firm Wiz tracked a campaign that exploited stolen GitHub tokens to run malicious workflows stealing repository secrets and cloud credentials; GitHub’s approval controls blocked public‑repo attacks, but private‑repo runs succeeded, prompting guidance on token revocation and secret rotation.