Starting Tuesday, an attacker used stolen credentials for 4,837 GitHub accounts to plant a secret stealer in repositories those accounts could write to, according to Aikido Security, a security software company. The stealer is built to take the secrets and cloud credentials that a repository's CI workflows can reach. It ran in at least 1,806 repositories, where the attacker has likely collected
Attacker Used 4,837 Hijacked GitHub Accounts to Run a CI Secret Stealer in 1,806+ Repositories
About this summary. This is a short excerpt from the description that The Hacker News published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://thehackernews.com/2026/11/4837-hijacked-github-accounts-ran-ci.html
Source attribution: headline and facts are from The Hacker News (thehackernews.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Attacker Targets 60,000 GitHub Repositories in Credential Theft Campaign
Using thousands of hijacked accounts, the wfx-loot campaign planted a CI secret stealer that ran in over 1,800 GitHub repositories.
Check your GitHub repos: A secret stealer hit tens of thousands of them
A threat actor using stolen GitHub credentials has pushed a credential-stealing payload into tens of thousands of repositories since November 10. In more than 1,800 of…
Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub
Passwords and API keys that developers typed into commands they approved in Claude Code are sitting in public GitHub repositories, where anyone can read them. When a…
Vercel rolls out new protection against stolen session cookie attacks
Vercel is gradually rolling out Device Bound Session Credentials (DBSC) on its platform as a key defense against information stealer malware.
What Malware Actually Does: An Empirical Analysis of Post-Infection Behavior Across Malware Families
arXiv:2611.03774v1 Announce Type: new Abstract: Most malware detection research focuses on identifying whether a file is malicious before it executes. Far less attention…
'Gheist' Weaponizes GitHub Tokens to Steal Cloud Secrets
An ongoing supply chain attack is harvesting credentials and sensitive data from thousands of developer repositories.