Attacker Hijacks 4,837 GitHub Accounts to Deploy CI Secret Stealer Across 1,806 Repositories
An attacker leveraged stolen credentials from 4,837 GitHub accounts to insert a sophisticated secret-stealing workflow into at least 1,806 repositories. The campaign began with test pull requests titled "docs: dependency audit notes" from branches named wfx-docs, targeting 61,764 repositories before deploying the stealer in successful cases. Aikido Security and SafeDep researchers documented the use of both workflow modifications and npm postinstall hooks, with the malware exfiltrating GitHub tokens, cloud credentials, and repository data to attacker-controlled servers and Telegram. The stealer also reached several open-source packages, including a malicious Packagist release and two Go modules, though package users were not always impacted. Overlaps with the earlier GhostAction campaign suggest credential reuse across multiple threat actors. Repository owners are advised to revoke tokens, rotate all accessible secrets, and monitor for specific indicators such as wfx- prefixed federated credentials in Azure and AWS.
The Hacker NewsNov 12, 2026Translated from English