Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories

What happened

Cybersecurity researchers have disclosed details of an ongoing credential-theft campaign that has compromised two high-profile open-source maintainer accounts to push a malicious workflow into over 340 repositories.