Threat actors are abusing GitHub automation features and malicious Visual Studio projects to push a new variant of the "Keyzetsu" clipboard-hijacking malware and steal cryptocurrency payments.

A clever threat campaign is abusing GitHub repositories to distribute the Lumma Stealer password-stealing malware targeting users who frequent an open source project repository or are subscribed ...

GitHub says that over 700,000 secrets across thousands of private repositories have been detected to date. If push protection is enabled, a scan will check for high-confidence leak patterns.