Malicious GitHub Actions Workflow Exfiltrating CI/CD Secrets to Webhook

Duo Tech@duotech

•updated Jul 24, 2026•1•0•4

Detects the malicious GitHub Actions workflow that exfiltrates PyPI/Codecov CI secrets to the attacker's known webhook.site endpoint.