Ethical Hacking News
A devastating GitHub attack has exposed 1,806+ repositories to a malicious CI secret stealer, with 4,837 hijacked accounts used to run the attack. The stealer extracts sensitive information from repositories and uses it to bypass security controls. The attack highlights the need for enhanced security measures and vigilance in the face of sophisticated cyber threats.
A recent GitHub attack used 4,837 hijacked accounts to run a malicious CI secret stealer across 1,806+ repositories.The stealer extracts sensitive information and copies recent workflow artifacts, posing a significant threat to repository security.The attacker can use extracted credentials to reach deeper into cloud accounts, bypassing security controls.Organizations are advised to revoke compromised credentials, turn on 2FA, and rotate sensitive information.A malicious package, digitalelvis/neuronai-studio, version 3.14.3, should be treated as compromised and blocked.The attack highlights the need for enhanced security measures, including secure credentials, robust access controls, and regular security audits.
A recent and devastating GitHub attack has left the cybersecurity community reeling, as an attacker utilized 4,837 hijacked accounts to run a malicious Continuous Integration (CI) secret stealer across 1,806+ repositories. This alarming development highlights the pressing need for enhanced security measures and vigilance in the face of sophisticated cyber threats.
The attack, which occurred on Tuesday, involved the use of stolen credentials for the hijacked GitHub accounts to plant the CI secret stealer. This malicious software is designed to extract sensitive information from repositories, including GitHub Actions secrets and variables, OIDC tokens, and keys for various AI services. The stealer also copies the repository's last 100 commits and recent workflow artifacts, making it a formidable threat to the security of affected repositories.
According to Aikido Security, a security software company, the stealer is built to use the extracted credentials to reach deeper into cloud accounts, exchanging GitHub OIDC tokens for AWS, GCP, and Azure sessions. This allows the attacker to create long-lived access keys for IAM users, effectively bypassing security controls. The stealer also has settings for private repositories, suggesting that it may be running in such environments.
The attack began with a series of pull requests titled "docs: dependency audit notes" opened from a branch named "wfx-docs" to test whether the account could write to the repository. These test pull requests were opened in 61,764 repositories, and the stealer followed in some of them. In a separate analysis, researchers at SafeDep, which sells software supply chain security tools, counted 8,093 repositories that received malicious commits between Tuesday and Wednesday, with 7,309 of those repositories experiencing the addition of the stealer to an existing workflow.
In 771 repositories, the stealer was added as an npm postinstall hook, which also runs on a developer's machine during npm install. The attacker typically reverts the change within minutes, leaving behind logs and potentially compromised credentials. In those repositories where the stealer ran, every secret and cloud role available to the workflows should be treated as compromised.
The attack has significant implications for the security of GitHub repositories, particularly those with sensitive information or cloud credentials. The SafeDep researchers advise owners of affected repositories to revoke commit author's tokens, OAuth app grants, SSH keys, and sessions, and to turn on 2FA. They also recommend rotating every secret and variable the repository can read.
In addition to the GitHub attack, the researchers have identified another malicious package, version 3.14.3 of the Packagist package digitalelvis/neuronai-studio, which should be treated as compromised. Users are advised to block this version and pin v3.14.2 or earlier.
The attack also has broader implications for the security of supply chains and the use of stolen credentials. The SafeDep researchers suggest checking for certain signs in repositories, such as a specific branch or pull request title, to determine if the stealer has been added. They also recommend checking for signs of malicious activity, such as changes to the repository's default branch or the addition of a specific script or postinstall hook.
The attack highlights the need for enhanced security measures, including the use of secure credentials, robust access controls, and regular security audits. It also underscores the importance of monitoring and responding to security incidents quickly and effectively. As the threat landscape continues to evolve, it is essential for organizations to stay vigilant and proactive in protecting their systems and data.
Related Information:
https://www.ethicalhackingnews.com/articles/Massive-GitHub-Attack-Exposes-1806-Repositories-to-CI-Secret-Stealer-ehn.shtml
https://thehackernews.com/2026/11/4837-hijacked-github-accounts-ran-ci.html
Published: Thu Nov 12 01:53:33 2026 by llama3.2 3B Q4_K_M
