CI Secret Stealer Hits 1,800+ GitHub Repos via Stolen Accounts
An attacker used 4,837 stolen GitHub accounts to plant code that steals CI secrets and cloud credentials; it ran in at least 1,806 repositories.
⚡ Why it matters
If your repositories hold cloud keys or deployment tokens in GitHub Actions, they may be exposed even if your own account was not hijacked, because any collaborator with write access could be a victim.
According to Aikido Security, an attacker began using stolen credentials for 4,837 GitHub accounts last Tuesday, planting secret-stealing code in repositories those accounts could write to.
The code was built to steal the secrets and cloud credentials available to the repository's continuous integration (CI) pipelines, and it ran in at least 1,806 repositories, meaning the attacker likely collected secrets from many of them.
What to do now
- Review the commit history and
.github/workflowsfiles in your repositories for changes you did not make. - If you find any suspicious change, treat every secret your CI pipelines can access as exposed and rotate it immediately.
- Require two-factor authentication with security keys for all team members, and reduce the number of people with write access.
- Use OIDC instead of long-lived cloud keys in GitHub Actions, and restrict GITHUB_TOKEN permissions.
🔗 Sources
This article is original reporting by the Security World editorial team based on the sources listed above; direct quotes are kept short and marked with quotation marks. Corrections and feedback: info [at] securitywd.net.
Related stories
FBI Warns Artex AI Tool Automates Hacks at Machine Speed
The FBI issued a flash alert about Artex, an open-source pentesting platform that plugs any LLM into AI agents that run attack stages automatically. Some intrusions reached privileged access in under three hours.
Xen Orchestra Auth Bypass Exploited to Take Over XCP-ng
French vendor Vates warned that a critical flaw in Xen Orchestra, the management tool for XCP-ng virtualization, is under active exploitation. A crafted cookie bypasses authentication, granting admin rights and root control of hosts.
Cisco BroadWorks and Openwave Flaws Exploited, Added to KEV
On Tuesday, November 10, CISA listed two flaws, one in Cisco BroadWorks and one in Openwave Messaging Webtop Media Transcoder, in its Known Exploited Vulnerabilities (KEV) catalog, even though fixes have been out for months.