---
id: 6930
title: "Code to Cloud Attacks: From Github PAT to Cloud Control Plane"
source_domain: wiz.io
source_url: "https://www.wiz.io/blog/github-attacks-pat-control-plane"
published_at: "2025-12-09T13:00:02Z"
tags: ["cloud", "supply-chain", "cloud-security", "secrets", "github", "ci-cd", "pat", "wiz-cirt"]
phying_url: "https://phying.com/item/6930"
lang: en
---

# Code to Cloud Attacks: From Github PAT to Cloud Control Plane

## Summary

Wiz CIRT reports GitHub PAT attacks escalating to cloud control-plane access: attackers enumerate Action secret names via unlogged code searches, then plant workflows that harvest CSP credentials.

## Intelligence Metadata

- **Sources:** wiz.io
- **Published:** 2025-12-09T13:00:02Z
- **Original:** https://www.wiz.io/blog/github-attacks-pat-control-plane
- **Phying News:** https://phying.com/item/6930