Daily Cyber News: Stolen GitHub tokens drain secrets from private repositories

An active campaign is using stolen GitHub tokens to extract secrets from private repositories. More than thirteen thousand five hundred malicious branches were recovered across over 850 compromised accounts. The attacker plants a workflow that encodes repository secrets, writes them into a run log, downloads that log through GitHub’s own A P I, and quickly deletes the evidence.

Key context: This activity can reach production credentials and cloud roles without contacting an outside server that defenders could simply block.

Additional detail: For leaders, the message is that private code storage isn’t a security boundary when valid tokens are stolen.

For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.

Topics: cybersecurity news, cybersecurity, cyber risk, Stolen GitHub, Stolen, GitHub, tokens, drain, secrets, private.

Daily Cyber News: GMO cloud breach puts trading accounts and customer data at risk

Customers of GMO Internet’s cloud desktop service face possible data theft and unauthorized trading activity. The company shut down the service after discovering unauthorized access. It later said information linked to customers and its business appeared to have been published online.

Key context: The service hosted Windows desktops used for foreign exchange trading, so the breach carries direct financial consequences.

Additional detail: For leaders, this is a reminder that slow action on known security improvements can turn technical debt into customer losses.

For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.

Topics: cybersecurity news, cybersecurity, cyber risk, windows, cloud, breach, trading, accounts, customer, data.

Daily Cyber News: Exposed key turns LiteLLM release into a supply-chain attack

A poisoned LiteLLM release exposed users to credential theft and remote access. The attack began with a master key accidentally published in a public repository in May. The file was removed, but the key wasn’t revoked.

Key context: The malicious package could steal browser data, cloud credentials, and keys for several AI providers.

Additional detail: The larger lesson is simple.

For more cybersecurity news and the full Daily Cyber newsletter, visit DailyCyber.News.
Cybersecurity training, courses, books, and resources: BareMetalCyber.com.

Topics: cybersecurity news, cybersecurity, cyber risk, credential theft, Exposed, LiteLLM, release, supply-chain, attack.