gh-token-monitor Script Execution

Ibrahim Saud@tektrix

•updated Jun 17, 2026•0•0•8

Detects the explicit execution of the 'gh-token-monitor.sh' script, which is indicative of active credential harvesting on the endpoint. This script is designed to monitor and potentially exfiltrate GitHub tokens.