[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fWS9M_cBEx7XsH03trY72kM8IiXwMMhB2bCo6QbCiKhU":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":50},"c5074bf5-ff2f-4b83-ae67-ce04d1c2801c","60000-github-repos-poisoned-via-hijacked-accounts-and-workflow-injection","49d8a860-b646-4ed6-bc9e-9a96e4244157","60,000 GitHub Repos Poisoned via Hijacked Accounts and Workflow Injection","The attacker compromised thousands of developer and bot accounts to inject credential-stealing code directly into GitHub Actions workflows, shell scripts, and npm hooks — trusted components of the software development pipeline. This is a classic supply chain attack: by targeting the build and automation layer rather than production systems directly, the attacker harvested GitHub tokens, cloud credentials, and AI service keys at scale. The incident highlights how overprivileged bot accounts and poorly reviewed CI\u002FCD configurations create a massive attack surface. When credentials stolen from one repository can pivot into AWS or Azure environments, the blast radius extends far beyond source code.","**Immediate actions:**\n- Audit all GitHub Actions workflows, npm hooks, and shell scripts in your repositories for unauthorized modifications or unexpected code insertions.\n- Rotate all GitHub tokens, cloud credentials (AWS, Azure), and AI service keys that may have been exposed in CI\u002FCD environments.\n- Revoke and re-issue credentials for any bot or service accounts associated with affected repositories.\n\n**Long-term improvements:**\n- Enforce least-privilege access for all developer and bot accounts, scoping GitHub tokens to only the repositories and permissions they strictly require.\n- Require code review and branch protection rules for all changes to CI\u002FCD pipeline files (e.g., `.github\u002Fworkflows\u002F`) to prevent unauthorized workflow modifications.\n- Adopt secrets management solutions (e.g., HashiCorp Vault, AWS Secrets Manager) so credentials are never embedded in workflow files or scripts.\n\n**Detection measures:**\n- Enable GitHub audit log streaming and alert on unexpected changes to workflow files, new workflow runs from unfamiliar accounts, or unusual token usage patterns.\n- Implement runtime monitoring in cloud environments (AWS CloudTrail, Azure Monitor) to detect lateral movement or anomalous API calls originating from CI\u002FCD pipelines.\n- Scan repositories continuously with secret-scanning tools to detect committed credentials before they can be exfiltrated.",[12,13,14,15,16],"MITRE ATT&CK T1195.001: Supply Chain Compromise: Compromise Software Dependencies and Development Tools","CIS Control 16: Application Software Security (v8)","NIST SP 800-53 SA-12: Supply Chain Protection","NIS2 Article 21(2)(d)","NIS2 Article 21(2)(j)",{"NIS2 Article 21(2)(d)":18,"NIS2 Article 21(2)(j)":19,"NIST SP 800-53 SA-12: Supply Chain Protection":20,"CIS Control 16: Application Software Security (v8)":21,"MITRE ATT&CK T1195.001: Supply Chain Compromise: Compromise Software Dependencies and Development Tools":22},"NIS2's supply chain security point requires managing security risks introduced by third-party developers and software suppliers, which applies here because hijacked developer accounts were used to poison shared repositories.","Requiring multi-factor authentication on developer and bot accounts would have made it significantly harder for the attacker to hijack the thousands of accounts used to plant malicious code.","SA-12 requires organizations to protect against supply chain threats in software and development tools, directly addressing the risk of attacker-injected code in shared repository workflows.","CIS Control 16 requires securing software development pipelines and reviewing code for malicious content, which would have detected unauthorized insertions into CI\u002FCD workflow files.","The attacker injected malicious code into GitHub Actions workflows and npm hooks — development tooling — to compromise downstream consumers of those repositories, which is exactly what this technique describes.","published","2026-11-12T14:21:55.814545+00:00","2026-11-12T14:21:55.79+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.securityweek.com\u002Fattacker-targets-60000-github-repositories-in-credential-theft-campaign\u002F","attacker-targets-60-000-github-repositories-in-credential-theft-campaign-92fa12","Attacker Targets 60,000 GitHub Repositories in Credential Theft Campaign",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":38,"name":39,"slug":40,"description":41,"color":42},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[44],{"id":45,"date":46,"edition":47,"title":48,"audio_url":49},"636c0875-eb3c-4df8-b0a8-59b022d18a1e","2026-11-12","afternoon","ThreatNoir Afternoon Brief — November 12","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-11-12\u002Fthreatnoir-afternoon-brief-2026-11-12.mp3",[51,55,59],{"slug":52,"name":53,"problem":54},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":56,"name":57,"problem":58},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",{"slug":60,"name":61,"problem":62},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped."]