Malicious Actor Uses Hijacked GitHub Accounts to Compromise Over 1,800 Repositories with CI Secret Stealer
A sophisticated attack has been discovered, where a malicious actor leveraged 4,837 hijacked GitHub accounts to run a Continuous Integration (CI) secret stealer in more than 1,806 repositories. The attacker’s goal was to steal sensitive credentials and secrets stored within the CI pipelines of these projects.
The compromised repositories belonged to various individuals and organizations across the globe, with some of them being prominent open-source developers. This attack highlights the vulnerability of GitHub users who have reused passwords or used weak authentication practices. The hijacked accounts were then used to run a script that extracted sensitive information from the CI pipelines, such as API keys, access tokens, and other credentials.
CI/CD pipelines are essential for modern software development, automating tasks like building, testing, and deployment of code changes. However, they also pose a significant security risk if not properly secured. In this case, the attacker exploited the fact that many developers store sensitive information in these pipelines to gain unauthorized access to their projects.
The malicious actor’s script was designed to target repositories using GitHub Actions, which is a popular CI/CD service within the GitHub ecosystem. The attack worked by creating new workflow files in each targeted repository, allowing the attacker to execute arbitrary code and extract sensitive data. This method of attack takes advantage of the fact that many developers grant broad permissions to their CI pipelines, making it easier for attackers to manipulate them.
This incident serves as a stark reminder of the importance of secure authentication practices and regular security audits. With more than 4,837 compromised accounts, this attack demonstrates how a single malicious actor can wreak havoc on numerous projects simultaneously. The fact that these repositories belonged to prominent open-source developers further emphasizes the need for robust security measures in the development community.
To avoid falling victim to similar attacks, developers must prioritize secure authentication practices, such as enabling two-factor authentication and using unique passwords for each account. Regularly reviewing CI pipeline configurations and implementing least-privilege access controls can also help mitigate the risk of unauthorized access. By taking these precautions, developers can protect their projects from being compromised by malicious actors.
Source: The Hacker News — 2026-11-12