GitHub Token Access Via GH CLI - Linux

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects the GitHub CLI (gh) being used to retrieve stored authentication tokens. Threat actors might access such tokens to gain unauthorized access to GitHub repositories, CI/CD pipelines, and other resources, potentially leading to data exfiltration, code tampering, or further lateral movement within the victim's environment.

2026-06-08 00:00:00

None

2a5c8f3e-9b1d-4e7a-c6f0-3d8b2e5a9c1f

attack.credential-access attack.t1528

Nextron Sigma feed only (private)