Attacker hijacks 4,837 GitHub accounts to steal CI secrets

An attacker used stolen credentials for 4,837 GitHub accounts to plant a secret stealer in repositories those accounts could write to, according to Aikido Security, a security software company. The campaign was reported on 12 November 2026 and began on the Tuesday of that week, Aikido said. The payload ran in at least 1,806 repositories, where the attacker has likely already collected secrets, according to the company.

The stealer is built to take the secrets and cloud credentials that a repository's continuous integration workflows can reach, Aikido said. Continuous integration, or CI, is the automated process that builds and tests code every time it changes. On GitHub, those jobs run through GitHub Actions, and they are routinely handed access tokens, deployment keys and cloud credentials so they can do their work without a human present. Any code added to a workflow file inherits that access.

That is what makes write access to a repository valuable to an attacker. Rather than breaking into a cloud account directly, the attacker only needed to get a change into the pipeline and wait for it to run. The hijacked accounts provided that write access across a large number of projects at once, according to Aikido's account of the campaign.

The gap between the two figures is notable. Aikido reported 4,837 compromised accounts but at least 1,806 repositories where the stealer actually ran. The company did not describe how the credentials for those accounts were obtained.

The pattern is a software supply chain attack, meaning the target is not one organisation's systems but the shared tooling and code that many organisations depend on. Secrets harvested from a CI pipeline can give access to systems well beyond the repository itself, because build pipelines often hold the keys needed to publish packages, push container images or deploy to production cloud environments.

Aikido has not published a full list of affected repositories in the material available, and the status of the campaign is reported rather than resolved. GitHub, whose Actions service the workflows ran on, has not been quoted in the available reporting.

For teams that use GitHub Actions, the practical question is whether any workflow file changed unexpectedly during the period described, and whether any credential that a pipeline can reach has been used since. Secrets that may have been exposed to a compromised pipeline are generally treated as burnt and rotated, because a stolen token remains valid until it is revoked regardless of how it was taken.

The incident is a reminder that automated build systems are a form of agent in their own right. They act on code without a person approving each step, they hold credentials with real power, and they run whatever instructions appear in the repository they are watching. Account compromise at the developer level therefore converts quickly into credential compromise at the infrastructure level.

No figures have been published on how many secrets were successfully exfiltrated, which organisations were affected, or what the attacker has done with the material collected. Aikido described the harvest as likely rather than confirmed.