Xygeni GitHub Action Compromised Via Tag Poison

Attackers operated an active C2 implant for up to a week, and researchers argue the application security vendor should have done more to address the issue.