Auto force push attacking all repos and branches.... adding malicious config.bat file

[mehediScriptDev]

did you guys experience a kinda thing in github, auto force pushes happening on every repo and all branches, and a config.bat file being injected automatically? It's continuously happening to our office organization even after we clean it up

when github solve this issue? any idea?

[github-actions[bot]]

💬 Your Product Feedback Has Been Submitted 🎉

Thank you for taking the time to share your insights with us! Your feedback is invaluable as we build a better GitHub experience for all our users.

Here's what you can expect moving forward ⏩

• Your input will be carefully reviewed and cataloged by members of our product teams. 
  • Due to the high volume of submissions, we may not always be able to provide individual responses.
  • Rest assured, your feedback will help chart our course for product improvements.
• Other users may engage with your post, sharing their own perspectives or experiences. 
• GitHub staff may reach out for further clarification or insight. 
  • We may 'Answer' your discussion if there is a current solution, workaround, or roadmap/changelog post related to the feedback.

Where to look to see what's shipping 👀

• Read the Changelog for real-time updates on the latest GitHub features, enhancements, and calls for feedback.
• Explore our Product Roadmap, which details upcoming major releases and initiatives.

What you can do in the meantime 💻

• Upvote and comment on other user feedback Discussions that resonate with you.
• Add more information at any point! Useful details include: use cases, relevant labels, desired outcomes, and any accompanying screenshots.

As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities.

Thank you once again for your contribution to making GitHub even better! We're grateful for your ongoing support and collaboration in shaping the future of our platform. ⭐

[Lopesnextgen]

I’d treat this as an active compromise, not a GitHub bug

This doesn’t sound like a normal GitHub platform issue. Auto force-pushes across many repos/branches + a config.bat being re-injected usually means something with write access is still compromised.

Most likely candidates:

• compromised org member/owner account
• leaked PAT / fine-grained token / classic token
• SSH key or deploy key
• OAuth App or GitHub App authorization
• CI/CD secret used by a bot or machine user
• self-hosted runner or infected office workstation
• automation/webhook that keeps re-pushing the same payload

Cleaning the repositories won’t stop it if the credential doing the push is still valid.

What I’d do immediately

• Temporarily disable suspicious GitHub Actions/workflows
• Quarantine or remove self-hosted runners
• Revoke/rotate PATs, SSH keys, deploy keys, OAuth app access, GitHub App credentials, and CI secrets
• Check the organization audit log for git.push events around the exact timestamps
• Look for repeated actor, IP, user-agent, token_id, or programmatic access type
• Inspect config.bat, but do not run it
• Block force pushes using branch protection/rulesets
• Require 2FA/SSO and review all org members/admins

GitHub’s audit log docs mention that git.push events include useful fields like actor, repo, token info, user agent, and transport protocol. For GitHub Enterprise Cloud, git events may need to be accessed through API/export and have limited retention, so I’d export them quickly.

About “when will GitHub solve it?”

Unless GitHub confirms a platform incident, there probably isn’t a global fix for this. From GitHub’s side, these may look like valid authenticated pushes if the attacker has a real token/key/session.

So the practical fix is: find the credential or automation doing the pushes, revoke it, then restore the repos.

Useful links:

• GitHub incident investigation areas: https://docs.github.com/en/code-security/reference/security-incident-response/investigation-areas
• Audit log events: https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/audit-log-events-for-your-organization
• Revoke authorizations/tokens: https://docs.github.com/en/enterprise-cloud@latest/admin/managing-iam/respond-to-incidents/revoke-authorizations-or-tokens
• Branch protection rules: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule
• GitHub Status: https://www.githubstatus.com/