Massive Credential Theft Breach Compromises Nearly 5,000 GitHub Accounts to Steal Software Development Secrets
In early November 2026, threat actors compromised the credentials of 4,837 GitHub accounts to access and probe 61,764 repositories focusing on stealing secrets from software development pipelines and cloud environments. The attackers used stolen credentials to inject malicious workflows, resulting in exfiltration of GitHub Actions secrets, workflow tokens, runtime credentials, and cloud access credentials including AWS, Google Cloud, and Azure. This campaign involved deploying malicious payload variants through continuous integration (CI) workflows, with attackers reverting changes rapidly to evade detection. At least 1,806 repositories showed evidence of credential exfiltration, and multiple repositories used by publicly published package maintainers were affected, creating risk for downstream supply chain compromise. The attackers also deployed persistence techniques such as modifying AWS trust policies and injecting Azure federated identity credentials, allowing prolonged access despite secret rotations. Investigation and remediation require thorough review of deleted workflows, cloud identity changes, and exposed developer environments rather than only rotating tokens or removing malicious files. Although some overlap with prior GhostAction activity was observed, researchers did not attribute it to the same threat actor due to differing tactics and tooling.
Detalhes técnicos
Attackers initiated access by submitting pull requests that appeared as routine documentation changes, testing for write access with stolen credentials. Subsequent insertion of large workflow modifications or small scripts enabled secret collection via GitHub Actions, including continuous integration credentials and pod environment information. The campaign gathers extensive data including repository contents, Git history, build artifacts, and AI service credentials. The exfiltration channel observed was HTTP POST traffic to IPs 194.150.166[.]244:8080/exfil and 18.143.168[.]96:8080/exfil. Payloads affected package ecosystems including npm, Go, Packagist, and PyPI but primarily targeted CI credentials over package propagation. Persistence involves cloud token exchanges such as IAM role chaining and Azure token replay.
Remediação
Organizations should treat all secrets and cloud roles accessed through workflows as compromised. Investigations must include audit of deleted workflow runs, suspicious commits, cloud identity permissions, and developer endpoint exposure. Remediation cannot rely solely on token rotation or deleting malicious workflows due to persistence mechanisms. Providers and maintainers across multiple package ecosystems should review their roles and releases.
Vendor: GitHub Targeted Sectors: software development Attack Type: credential compromise, supply_chain Initial Access Vector: stolen credentials Threat Actors: unknown Malware Families: credential stealer Indicators of Compromise: 194.150.166[.]244:8080/exfil, 18.143.168[.]96:8080/exfil Affected Projects: Packagist digitalelvis/neuronai-studio 3.14.3, Go module github.com/onuragtas/docker-env v1.0.278 and v1.0.280
Urgency
The incident severity is high due to large-scale credential theft, broad exfiltration of sensitive CI and cloud secrets, and advanced persistence mechanisms that complicate remediation and increase risk to software supply chains.
Linha do tempo
-
Massive Credential Theft Breach Compromises Nearly 5,000 GitHub Accounts to Steal Software Development Secrets
ler a análise desta fonte ocultar
In early November 2026, threat actors compromised the credentials of 4,837 GitHub accounts to access and probe 61,764 repositories focusing on stealing secrets from software development pipelines and cloud environments. The attackers used stolen credentials to inject malicious workflows, resulting in exfiltration of GitHub Actions secrets, workflow tokens, runtime credentials, and cloud access credentials including AWS, Google Cloud, and Azure. This campaign involved deploying malicious payload variants through continuous integration (CI) workflows, with attackers reverting changes rapidly to evade detection. At least 1,806 repositories showed evidence of credential exfiltration, and multiple repositories used by publicly published package maintainers were affected, creating risk for downstream supply chain compromise. The attackers also deployed persistence techniques such as modifying AWS trust policies and injecting Azure federated identity credentials, allowing prolonged access despite secret rotations. Investigation and remediation require thorough review of deleted workflows, cloud identity changes, and exposed developer environments rather than only rotating tokens or removing malicious files. Although some overlap with prior GhostAction activity was observed, researchers did not attribute it to the same threat actor due to differing tactics and tooling.
Technical Details
Attackers initiated access by submitting pull requests that appeared as routine documentation changes, testing for write access with stolen credentials. Subsequent insertion of large workflow modifications or small scripts enabled secret collection via GitHub Actions, including continuous integration credentials and pod environment information. The campaign gathers extensive data including repository contents, Git history, build artifacts, and AI service credentials. The exfiltration channel observed was HTTP POST traffic to IPs 194.150.166[.]244:8080/exfil and 18.143.168[.]96:8080/exfil. Payloads affected package ecosystems including npm, Go, Packagist, and PyPI but primarily targeted CI credentials over package propagation. Persistence involves cloud token exchanges such as IAM role chaining and Azure token replay.
Remediation
Organizations should treat all secrets and cloud roles accessed through workflows as compromised. Investigations must include audit of deleted workflow runs, suspicious commits, cloud identity permissions, and developer endpoint exposure. Remediation cannot rely solely on token rotation or deleting malicious workflows due to persistence mechanisms. Providers and maintainers across multiple package ecosystems should review their roles and releases.
Vendor: GitHub Targeted Sectors: software development Attack Type: credential compromise, supply_chain Initial Access Vector: stolen credentials Threat Actors: unknown Malware Families: credential stealer Indicators of Compromise: 194.150.166[.]244:8080/exfil, 18.143.168[.]96:8080/exfil Affected Projects: Packagist digitalelvis/neuronai-studio 3.14.3, Go module github.com/onuragtas/docker-env v1.0.278 and v1.0.280
Urgency
The incident severity is high due to large-scale credential theft, broad exfiltration of sensitive CI and cloud secrets, and advanced persistence mechanisms that complicate remediation and increase risk to software supply chains.