A new campaign has revealed how AI-assisted automation is transforming cyberattacks, enabling threat actors to target hundreds of GitHub repositories at scale.
Tracked as “prt-scan” by security researchers, the operation highlights a critical shift:
Attackers no longer need sophistication — AI now provides scale.
What happened?
Researchers identified over 450 exploit attempts targeting open-source repositories on GitHub.
Key facts:
- The campaign has been active since March 11, 2026
- Executed in 6 waves using multiple accounts
- Over 500 malicious pull requests submitted
- ~10% success rate
- At least 2 NPM packages compromised
The technique: abusing GitHub workflows
The attack exploits a known risky configuration:
👉 pull_request_target in GitHub Actions
This trigger:
- Runs workflows automatically when a pull request is opened
- Executes with full repository permissions
- Can access secrets, tokens, and environment variables
⚠️ If misconfigured, it allows attackers to execute code from untrusted contributors
How the attack works
The attacker follows a repeatable playbook:
1. Scan repositories
Identify projects using pull_request_target
2. Fork & modify
Create a fork and introduce hidden malicious code
3. Submit pull request
Disguise payload as a normal update or fix
4. Trigger execution
Workflow runs automatically with elevated permissions
5. Extract secrets
Attempt to steal:
- GitHub tokens
- API keys
- Environment variables
- Cloud credentials
AI-driven scale
What makes this campaign different is how it was executed.
Researchers observed:
- Massive spike in activity within 26 hours
- ~475 pull requests opened rapidly
- Behavior consistent with AI-assisted automation
👉 This allowed the attacker to scale attacks across hundreds of targets simultaneously
Imperfect but still effective
Interestingly, the attack wasn’t highly sophisticated:
- Payloads contained logical flaws
- Misunderstood GitHub permission models
- Poor execution in some stages
Yet:
👉 ~10% success rate still led to dozens of compromises
Most affected targets were:
- Small or hobbyist projects
- Exposing temporary or limited credentials
Why this matters
This campaign signals a major shift:
Low-skill attackers can now perform large-scale supply chain attacks using AI.
Previously:
- Attacks were targeted and resource-intensive
Now:
- Automated
- Scalable
- Faster to deploy
- Harder to defend at scale
How to protect your repositories
1. Avoid pull_request_target for untrusted code
Use safer alternatives like pull_request
2. Restrict workflow permissions
Limit access to secrets and tokens
3. Require manual approvals
Before running workflows from forks
4. Monitor pull request activity
Watch for unusual volume or patterns
5. Rotate and scope credentials
Minimize impact if exposure occurs
Key takeaway
This campaign delivers a clear warning:
AI is lowering the barrier to entry for large-scale cyberattacks.
Even imperfect attacks can succeed when executed at scale.
For organizations, the focus must shift from preventing individual attacks to defending against automated campaigns.
