Attacker Used 4,837 Hijacked GitHub Accounts to Run a CI Secret Stealer in 1,806+ Repositories

An attacker utilized stolen credentials from over 4,800 GitHub accounts to deploy a secret stealer in more than 1,800 repositories. The stealer was designed to extract secrets and cloud credentials accessible to the repositories' CI workflows. The attack began on Tuesday and was carried out using accounts that the attacker had hijacked, allowing them to write to the targeted repositories. The attacker likely collected sensitive information from these repositories. The security software company Aikido Security discovered the attack. The scope of the attack suggests a significant breach of GitHub accounts and repositories.