SecurityWeek

Ghost Accounts Abuse GitHub API in Mass Recon Campaign

Multiple threat actors are abusing the GitHub API to discover organizations’ repositories and members via ghost accounts.
Hosted on MSN

Hackers just walked off with 3,800 of GitHub’s internal code repositories — smuggled out by a single poisoned plugin a GitHub developer trusted

Somewhere inside GitHub, a developer installed a Visual Studio Code extension. It looked like any other productivity plugin in Microsoft’s marketplace. It wasn’t. That single installation gave ...
InfoWorld

GitHub’s public APIs are becoming an enterprise reconnaissance tool

Researchers have uncovered a sustained campaign using GitHub's public APIs and ghost accounts to profile enterprise software ...
VentureBeat

GitHub confirms 3,800 internal repos stolen through poisoned VS Code extension as supply chain worm hits Microsoft’s Python SDK

GitHub confirmed on May 20 that a poisoned VS Code extension installed on an employee’s device gave attackers access to roughly 3,800 internal repositories at the Microsoft-owned code storage and ...
InfoWorld

GitHub admits major source code leak after 3,800 internal repositories breached

Microsoft’s GitHub has suffered what appears to be its biggest ever security breach after confirming that attackers exfiltrated code from around 3,800 of the company’s internal repositories. News of ...
TechCrunch

GitHub says hackers stole data from thousands of internal repositories

GitHub, the popular developer platform owned by Microsoft, confirmed it was hacked and attackers had stolen data from around 3,800 internal code repositories. The code hosting and sharing giant said ...
Hosted on MSN

GitHub investigates unauthorized access to internal repositories

GitHub said on Wednesday it is investigating unauthorized access to its internal repositories following the compromise of an employee's device. “While we currently have no evidence of impact to ...