Comment on AWS merges malicious PR into Amazon QparentComments−wunderwuzzi231yAWS issued a post and they talk about revoking and replacing a credential.So maybe the hacker was able to directly push?https://aws.amazon.com/security/security-bulletins/AWS-2025-...−unitof1yJoseph's 404 article quotes the hacker as saying they "got admin privileges on a silver platter," so I think this is it: first part of the breach was gaining the GitHub permission to create a branch. Possibly just by asking.
Comments
AWS issued a post and they talk about revoking and replacing a credential.
So maybe the hacker was able to directly push?
https://aws.amazon.com/security/security-bulletins/AWS-2025-...
Joseph's 404 article quotes the hacker as saying they "got admin privileges on a silver platter," so I think this is it: first part of the breach was gaining the GitHub permission to create a branch. Possibly just by asking.