GitHub dead-drop exfiltration
Named by 2 kept items in this workspace.
Search every workspace for GitHub dead-drop exfiltration. It matches the name as written, so it can find other things that share it.
The items that name it 2
Exfiltration technique reused from the Shai-Hulud worm, using a GitHub-hosted location as a dead drop for stolen data
Stolen credentials encrypted and committed to GitHub repositories via the GitHub GraphQL API using the victim's own token; no external attacker-controlled domain is contacted.
All techniques in this workspace.