Hackers hide malicious payloads in 42 GitHub repositories using large files

Hackers have compromised 42 third-party GitHub repositories by using oversized payload files, according to research from JFrog Security Research reported by CSO Online. Dark Reading reported that a supply chain attack campaign known as GhostAction has shifted its focus toward developer endpoints and cloud access. [1][2]

CSO Online reported that the attackers deployed payload blobs that were large enough to evade the GitHub search and API paths that are normally used to detect compromises. The underlying security protections on GitHub were not breached, but individual customer protections were compromised. CSO Online added that autonomous coding agents played a role in the incident. [2]

GitHub is a developer platform operated by Microsoft subsidiary GitHub, Inc. that provides distributed version control and project management tools, including continuous integration. [5]

Dark Reading reported that although the initial hacking wave has slowed down, attackers remain present inside GitHub environments. The shift toward developer endpoints signals potential future tactics for the cybercrime outfit. [1]