4,837 Hijacked GitHub Accounts Used to Steal CI Secrets

Starting Tuesday, an attacker deployed a secret-stealing tool across at least 1,806 repositories by exploiting 4,837 hijacked GitHub accounts. The campaign employed a consistent tactic: pull requests titled “docs: dependency audit notes” from wfx-docs branches probed write access in 61,764 repositories before the stealer was deployed. In roughly 7,309 cases the stealer inserted itself into existing workflows; in 771 others it arrived as a postinstall hook in npm packages.

The stealer extracts credentials from CI environments comprehensively: GitHub Actions secrets, workflow tokens, and keys for AWS, Azure, GCP, Kubernetes, npm, PyPI, and SSH tools. Critically, it weaponizes captured credentials—rewriting AWS role trust policies to grant access from any account, creating long-lived AWS access keys, and injecting federated identity credentials into Azure AD to persist beyond token rotation. Stolen data is exfiltrated via HTTP POST or Telegram channels.

The intrusion reached at least one Packagist package and multiple Go modules, though researchers assess the attacker prioritizes CI secrets over package poisoning. The campaign reuses accounts from October’s GhostAction wave, with previously compromised accounts showing roughly 1,000 times higher likelihood of abuse this week, indicating systematic targeting of known vulnerable infrastructure.