[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fUxSesps-0kHD8vI_IdU0OuhZ55jYJX-UpEmwsaAYwCw":3},{"article":4,"iocs":46,"watch_terms":50,"solutions":51,"lesson":141},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":24,"category":25,"article_tags":28},"96097682-989c-4b67-9bc0-44b7b840bfd5","Compromised GitHub accounts push CI secret stealer to tens of thousands of repositories","compromised-github-accounts-push-ci-secret-stealer-to-tens-of-thousands-of-repos-8f22bc","A wave of compromised accounts are pushing a CI secret stealer. See if you’re affected, what it steals, and what to rotate. Category: Vulnerabilities & Threats","A threat actor has been using stolen GitHub credentials to inject a malicious workflow payload into tens of thousands of repositories since November 10th. This payload steals GitHub Actions secrets and cloud credentials. The campaign has also seen the payload enter published packages via automated triggers, with specific versions of Packagist and Go modules identified as compromised.","Compromised GitHub accounts push CI secret stealer to tens of thousands of repositories.","https:\u002F\u002Fwww.aikido.dev\u002Fblog\u002Fcompromised-github-accounts-push-ci-secret-stealer-to-tens-of-thousands-of-repositories",null,"2026-11-12T01:45:00+00:00","2026-11-12T03:00:31.291041+00:00",9,[17,20,22],{"name":18,"type":19},"GitHub Actions","product",{"name":21,"type":19},"Packagist",{"name":23,"type":19},"Golang","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":24,"icon":12,"name":26,"slug":27},"Threat Intelligence","threat-intelligence",[29,34,39,44],{"category":30},{"id":31,"icon":12,"name":32,"slug":33},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":35},{"id":36,"icon":12,"name":37,"slug":38},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":40},{"id":41,"icon":12,"name":42,"slug":43},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":45},{"id":24,"icon":12,"name":26,"slug":27},[47],{"type":43,"value":48,"context":49},"CI secret stealer","Type of malicious payload",[18,21,23],{"controls":52,"vendors":137},[53,82,111],{"slug":54,"name":55,"problem":56,"products":57},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[58,66,74],{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"slug":83,"name":84,"problem":85,"products":86},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[87,95,103],{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",{"slug":112,"name":113,"problem":114,"products":115},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[116,121,129],{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":117,"product_name":118,"url":119,"description":120},"managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",[138],{"slug":88,"name":89,"logo_path":90,"roles":139},[140],"affected",{"slug":142,"title":143,"body":144,"framework_refs":145,"framework_notes":151},"stolen-github-credentials-enable-mass-ci-secret-theft-across-tens-of-thousands-of-repositories","Stolen GitHub Credentials Enable Mass CI Secret Theft Across Tens of Thousands of Repositories","Attackers leveraged compromised GitHub credentials to inject malicious workflow files into tens of thousands of repositories, silently exfiltrating GitHub Actions secrets and cloud credentials during CI\u002FCD pipeline execution. The attack propagated further through automated triggers in published package ecosystems such as Packagist and Go modules, amplifying the blast radius into downstream consumers. This illustrates how a single set of stolen credentials can weaponize a trusted software supply chain at massive scale. Secrets stored in CI\u002FCD environments are high-value targets precisely because they often carry privileged access to cloud infrastructure, container registries, and deployment systems.",[146,147,148,149,150],"MITRE ATT&CK T1195.001: Supply Chain Compromise: Compromise Software Dependencies and Development Tools","NIST SP 800-53 SA-12: Supply Chain Protection","CIS Control 4: Secure Configuration of Enterprise Assets and Software","NIS2 Article 21(2)(d)","NIST CSF 2.0 DE.CM-09: Monitoring of Computing Hardware, Software, and Services",{"NIS2 Article 21(2)(d)":152,"NIST SP 800-53 SA-12: Supply Chain Protection":153,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":154,"NIST CSF 2.0 DE.CM-09: Monitoring of Computing Hardware, Software, and Services":155,"MITRE ATT&CK T1195.001: Supply Chain Compromise: Compromise Software Dependencies and Development Tools":156},"This point mandates supply chain security measures, directly applicable because the attack propagated through trusted package registries and CI\u002FCD pipelines relied upon by many organizations.","This control requires organizations to protect against supply chain threats, which would have driven scrutiny of third-party workflow actions and package dependencies before they were ingested.","Enforcing least-privilege repository permissions and restricting who can modify workflow files would have limited an attacker's ability to inject malicious CI configuration at scale.","Continuous monitoring of CI\u002FCD pipeline activity and workflow file changes would have detected the unauthorized injection of malicious payloads into repositories early in the campaign.","The attackers injected malicious workflow payloads into repositories and published packages, directly compromising the software supply chain that downstream consumers trust."]