step-security Jul 22, 2026 · Crawled Jul 22, 2026

Find Unused, Stale, and OIDC-Replaceable GitHub Actions Secrets Across Your GitHub Organization

1 Malware

AI Summary

Threat actors are increasingly targeting GitHub Actions secrets through campaigns like GhostAction and Megalodon, which exfiltrated thousands of secrets from public repositories. These attacks exploit the accumulation of unused, stale, or long-lived credentials that organizations fail to clean up. The Shai-Hulud worm exemplifies the risk, spreading by stealing npm tokens to publish malicious packages. Transitioning to OIDC-based authentication and eliminating unused secrets can reduce the attack surface significantly.

AI-extracted · verify before operational use

Extracted Entities 1 found

Malware Shai-Hulud →

MITRE ATT&CK TTPs 5 techniques

T1071.003 Mail Protocols · Command And Control T1195 Supply Chain Compromise · Initial Access T1485 Data Destruction · Impact T1555 Credentials from Password Stores · Credential Access T1566 Phishing · Initial Access