Massive Credential Theft Campaign Using 4,837 Hijacked GitHub Accounts to Deploy CI Secret Stealer
Starting November 10, 2026, attackers used stolen credentials from 4,837 GitHub accounts to plant a sophisticated secret stealer targeting CI workflows in over 1,800 repositories, with malicious activity observed in upwards of 8,000 public repositories. The campaign involved opening pull requests titled "docs: dependency audit notes" to test write access and subsequently injecting a stealer designed to exfiltrate secrets and cloud credentials from GitHub Actions workflows, including AWS, Azure, GCP, npm, and other environments. The stealer also attempted persistence by rewriting trust policies and adding federated identity credentials, enabling long-term unauthorized access despite secret rotation. Key indicators include specific commit messages, branch naming patterns, and a known stealer SHA-256 hash. Users are advised to revoke all related tokens, rotate credentials, enable two-factor authentication, and consider affected machines compromised, especially if npm install was run on tainted packages.
Linha do tempo
-
Massive Credential Theft Campaign Using 4,837 Hijacked GitHub Accounts to Deploy CI Secret Stealer
ler a análise desta fonte ocultar
Starting November 10, 2026, attackers used stolen credentials from 4,837 GitHub accounts to plant a sophisticated secret stealer targeting CI workflows in over 1,800 repositories, with malicious activity observed in upwards of 8,000 public repositories. The campaign involved opening pull requests titled "docs: dependency audit notes" to test write access and subsequently injecting a stealer designed to exfiltrate secrets and cloud credentials from GitHub Actions workflows, including AWS, Azure, GCP, npm, and other environments. The stealer also attempted persistence by rewriting trust policies and adding federated identity credentials, enabling long-term unauthorized access despite secret rotation. Key indicators include specific commit messages, branch naming patterns, and a known stealer SHA-256 hash. Users are advised to revoke all related tokens, rotate credentials, enable two-factor authentication, and consider affected machines compromised, especially if npm install was run on tainted packages.