On April 2, 2026, security researchers uncovered a massive, automated attack campaign targeting GitHub repositories. The attacker, using the account “ezmtebo,” launched over 475 malicious pull requests (PRs) in just 26 hours.
They aimed at both major organizations and small hobbyist projects. This aggressive tactic reminded experts of previous AI-driven attacks. However, recent findings show that this public discovery was only the final chapter of a much longer story.
The core of this campaign exploited a well-known GitHub Actions feature, the pull_request_target trigger. Normally, when someone submits a PR from a forked repository, the automated workflows run with restricted permissions.
However, the pull_request_target trigger allows workflows to run with the base repository’s full permissions, granting access to sensitive repository secrets.
The attacker followed a highly automated playbook. First, they searched for repositories utilizing this specific trigger.
Then they forked the target project and created a new branch named “prt-scan”. Next, they injected malicious code into files that automatically execute during Continuous Integration (CI), such as package.json for Node.js or conftest.py for Python.
AI Automation Meets Poor Execution
Despite the rapid speed and adaptive nature of the AI-generated attacks, the execution was remarkably flawed.
The attacker built an ambitious five-phase payload designed to extract data, scan for secrets, bypass security labels, and run background tasks. However, many of these steps made no logical sense within GitHub’s environment.
For instance, the code attempted to bypass label-based security gates by creating new labels. This requires write access that the workflows did not have.
Similarly, the attacker attempted to create new workflows using stolen tokens, despite their heavily restricted permissions. Furthermore, the system frequently injected the wrong file types into projects, like putting Rust files into a Python repository.
Still wiz, the campaign was not a total failure. Out of roughly 500 attempts, the attacker managed to breach dozens on smaller projects. They compromised at least two npm packages and stole verified credentials for AWS, Cloudflare, and Netlify.
This campaign highlights a new era of supply chain threats. Attackers are using AI to automate strikes faster than human reviewers can catch them.
In response to such threats, GitHub has been actively updating its 2026 security roadmap to combat rising CI/CD supply chain attacks.
To defend against these automated threats, experts recommend enforcing contributor approval gates and restricting the permissions of automated workflows to neutralize similar attacks before they cause harm.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
