gh-token-monitor Credential Exfiltration via Curl

Ibrahim Saud@tektrix

•updated Jun 17, 2026•0•0•7

Detects curl commands transmitting harvested GitHub tokens (ghp_ prefix) in the request body, representing the final exfiltration stage of gh-token-monitor.