GitHub Auth Token Extraction Via CLI

Robert Fly@robertfly

•updated Jun 3, 2026•7•0•36

Detects the execution of the GitHub CLI command 'gh auth token'. This behavior was observed being used by the hijacked Bitwarden CLI npm package (TeamPCP campaign) to extract and steal active GitHub credentials from developer environments.