GitHub API

Tool

Threat entity extracted from intelligence sources

Frequency

occurrences

First Seen

December 10, 2025

Last Seen

May 26, 2026

API

GitHub Actions Secrets can contain critical credentials, and a recent report highlights that Personal Access Tokens (PATs) stored in these secrets may no longer be secure, providing attackers with a direct path into cloud environments via CI/CD workflows.

Overview

Recent Events

Relationships

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Related Clusters (3)

Related Entities

Malware Supply Chain Attack Ransomware Megalodon Azure Tiledesk Democratic People's Republic Of Korea CWE-200 - Exposure of Sensitive Information Government Technology Shai-hulud T1041 - Exfiltration Over C2 Channel

GitHub API

Overview

Recent Events

Profile

Used By

Associated Malware

Attack Types

MITRE Techniques

Platforms

Campaigns

Regions

Sectors Targeted

Relationships

Related Clusters (3)

Megalodon Campaign Infects Over 5,500 GitHub Repositories with Malware

North Korean Threat Actors Exploit Remote Tech Hiring for Fraud

Exposed GitHub PATs Enable Cloud Environment Breaches

Related Articles (3)

Feeding Frenzy: 'Megalodon' Malware Infects Thousands of GitHub Repos

Okta warns of North Korean fraud in remote tech hiring

GitHub Action Secrets aren’t secret anymore: exposed PATs now a direct path into cloud environments

Related Entities