GitHub CLI Token Extraction

Duo Tech@duotech

•updated Jun 3, 2026•3•0•13

Detects the execution of the GitHub CLI command used to print the active authentication token, which is abused by the Shai-Hulud worm to steal developer credentials.