# Massive GitHub Account Breach Exploited for CI Secret Theft

*Published November 13, 2026*
*Source: [https://thehackernews.com/2026/11/4837-hijacked-github-accounts-ran-ci.html](https://thehackernews.com/2026/11/4837-hijacked-github-accounts-ran-ci.html)*

## Executive Summary

An attacker compromised 4,837 GitHub accounts to deploy a secret-stealing tool across over 1,800 repositories, targeting continuous integration credentials. The breach has affected both public and private repositories, with potential impacts on package managers and developer machines.

*This is a Premium edition: its actionable insights are available to sec-news.ai Premium members —*
*[read the story](https://www.sec-news.ai/news/massive-github-account-breach-exploited-for-ci-secret-theft) or [see plans](https://www.sec-news.ai/pricing).*

## Article

Recently, an extensive cyberattack compromised 4,837 GitHub accounts, allowing an attacker to deploy a secret-stealing tool across numerous repositories. Aikido Security, a cybersecurity firm, reported that the attacker used stolen credentials to plant malicious code in repositories accessible by these accounts. The malicious tool specifically targeted secrets and cloud credentials available through continuous integration workflows, operating in at least 1,806 repositories.

The attack began with a pull request titled 'docs: dependency audit notes' from a branch named 'wfx-docs' to test if the account had write access to the repository. These test requests were made to 61,764 repositories, with the stealer being deployed in some. SafeDep, a company specializing in software supply chain security, identified 8,093 repositories with malicious commits, although not all had the stealer executed. The tool also inserted itself into existing workflows in 7,309 cases, using an npm postinstall hook in 771 others, which could compromise developer machines during npm installs.

Post-deployment, attackers typically reverted the changes within minutes and deleted logs, making detection challenging. Nonetheless, any repository that received these test pull requests should consider its credentials compromised. The attack affected repositories beyond those owned by the compromised accounts, with 92% of test pull requests submitted via collaborator or organization access remaining open upon inspection.

The stealer extracts credentials from various sources, including GitHub Actions secrets, GITHUB_TOKEN, and other cloud service tokens. It extends its reach by exchanging tokens for AWS, GCP, and Azure sessions and creating long-lived access keys. The attacker also targeted some private repositories, suggesting a wider impact.

Notably, the attack reached package managers like Packagist and Go modules through automated publishing triggers. Versions of certain packages were flagged as malicious, urging users to block specific versions and treat any affected machines as compromised. Although similarities exist with a previous attack in October, Aikido Security has not yet attributed this incident to the same actor due to differing tools and infrastructure.