Gheist turns GitHub Actions into a secret extraction service

A threat actor dubbed Gheist is turning compromised GitHub accounts into credential-harvesting platforms. By planting malicious GitHub Actions workflows in private repositories, attackers can expose repository and environment secrets, then retrieve them…

Preview courtesy of InfoWorld. The full article opens on their site.