International
The Morning Dev

Only the news worth knowing

‹
 
S93/100

Breach · high

CI secret stealer pushed via thousands of hijacked GitHub accounts

Tier S · Shit hits the fan – Drop everything

Who’s exposed: Repositories written to by 4,837 hijacked GitHub accounts, over 1,800 with the malware run

Tier S because: Core infrastructure AND exploited in the wild AND (full takeover OR secrets exposed)

Reach

Attack

Damage

Fix

Core infrastructure · Popular tool · Exploited in the wild · Full takeover · Secrets exposed · Supply chain

What to do

  1. Check your GitHub repositories for the injected secret stealer payload, as described by Aikido Security and the Help Net Security article
  2. Rotate GitHub Actions secrets and cloud credentials that may have been exposed in CI runs

The Brief

  • An attacker used stolen credentials for 4,837 GitHub accounts to plant a secret stealer in repositories those accounts could write to, according to Aikido Security.
  • The payload runs in CI and is built to take secrets and cloud credentials; it has pushed into tens of thousands of repositories since November 10.
  • In more than 1,800 repositories the malware ran and shipped GitHub Actions secrets and cloud credentials to the attacker.

Why it matters

Any repository where the compromised accounts had write access, and where GitHub Actions secrets or cloud credentials are stored, may have leaked those secrets to the attacker.

The checklist behind the tier

Checklist · 7 of 10 yes
YesHits tech teamsJudgment: GitHub and its Actions CI pipelines are used and run by developers and ops teams.
YesCore infrastructureJudgment: GitHub is named core infrastructure that nearly every team relies on.
YesPopular toolJudgment: GitHub is a widely used developer platform; coreInfra is yes.
YesExploited in the wildThe Hacker News: attacker used stolen credentials for 4,837 accounts; Help Net Security: malware ran in more than 1,800 repos.
NoPublic exploitNeither source says exploit code or a step-by-step proof-of-concept was published.
NoRemote, no loginSources say the attacker used stolen GitHub credentials, so authentication was required.
YesFull takeoverThe Hacker News: attacker used stolen credentials for 4,837 GitHub accounts, a full account takeover.
YesSecrets exposedHelp Net Security: malware shipped GitHub Actions secrets and cloud credentials to the attacker.
YesSupply chainHelp Net Security: credential-stealing payload pushed into tens of thousands of repositories, reaching CI pipelines.
NoNo fix yetNeither source states whether a fix or patch exists, so the answer is no.

Timeline

  1. Attacker begins pushing the credential-stealing payload into repositories

  2. Aikido Security's findings are reported by The Hacker News and Help Net Security

  3. Aikido Security's Blog

    Compromised GitHub accounts push CI secret stealer to tens of thousands of repositories

  4. The Hacker News

    Attacker Used 4,837 Hijacked GitHub Accounts to Run a CI Secret Stealer in 1,806+ Repositories

  5. Step Security Blog

    WFX Phantom: The GitHub Actions Secret Stealer That Deletes Its Tracks

  6. Help Net Security

    Check your GitHub repos: A secret stealer hit tens of thousands of them

Full coverage · 4 sources

First seen · 4 sources · Full story page · How tiers are decided