IncidentsAttacker hijacks 4,837 GitHub accounts to steal CI secrets
Security firm Aikido Security says a secret-stealing payload ran in at least 1,806 repositories after an attacker used stolen GitHub credentials.
12 Nov 2026
Attacker Uses 4,837 Hijacked GitHub Accounts to Plant CI Secret Stealer
An attacker leveraged stolen credentials for 4,837 GitHub accounts to insert a secret-stealing payload into CI workflows across at least 1,806 repositories, aiming to harvest cloud credentials and other secrets accessible to those pipelines.
Disclosed 12 November 2026 · Record updated 12 November 2026
Impact
Malicious code was planted in CI workflows of over 1,806 repositories to exfiltrate secrets and cloud credentials, using credentials from 4,837 hijacked GitHub accounts.
Our coverage
IncidentsSources
- thehackernews.comhttps://thehackernews.com/2026/11/4837-hijacked-github-accounts-ran-ci.html