黑客劫持 1900 个 GitHub 账号,向 3 万个仓库植入窃密工作流
GitGuardian 追踪的 GhostAction 攻击中,黑客用窃取的开发者凭据访问约 1900 个 GitHub 账号,向超过 3 万个仓库植入伪装成安全任务的恶意 GitHub Actions 工作流,窃取 CI/CD 密钥、云访问密钥以及 Anthropic、OpenAI、OpenRouter 的 API token。攻击在 10 月 8 日和 9 日集中爆发,波及约 3000 个用户和组织,尝试提取 3174 个密钥,窃取数据被发送至 193.32.204.199。GitHub 的审批控制拦截了大部分恶意工作流,但截至 10 月 5 日,8 月和 9 月受影响的 772 个仓库中仅 124 个完成清理,GitGuardian 建议撤销受影响账号凭据并轮换云密钥与 AI 服务 API key。
beyond the secrets explicitly referenced by workflows, using actions/checkout@v4 with fetch-depth: 0 to scan the working tree and Git history for AWS keys, GitHub and GitLab PATs, Google and Firebase keys, and API tokens from Anthropic, OpenAI and OpenRouter. Later versions captured surrounding lines to pair AWS key IDs with their corresponding secret access keys. The harvested credentials were sent over HTTP to 193.32.204.199, including keys removed from the current codebase but still present i
匹配字段正文
