Compromised GitHub accounts push CI secret stealer to tens of thousands of repositories

Tier S · Shit hits the fan – Drop everything

Who’s exposed: Repositories and CI pipelines tied to compromised GitHub accounts

Tier S because: Core infrastructure AND exploited in the wild AND (full takeover OR secrets exposed)

Reach

Attack

Damage

Fix

Core infrastructure · Popular tool · Exploited in the wild · Full takeover · Secrets exposed · Supply chain

What to do

Check whether your repositories are affected, using the guidance in the Aikido Security article
Rotate the CI secrets the article identifies as exposed

The Brief

A wave of compromised GitHub accounts is pushing a CI secret stealer to tens of thousands of repositories.
The source article covers how to tell whether you are affected, what the stealer takes, and what to rotate.

Why it matters

Repositories that receive the stealer can expose CI secrets, so developers need to check their pipelines and rotate any credentials that may have leaked.

The checklist behind the tier

Checklist · 7 of 10 yes

Yes	Hits tech teams	Judgment: GitHub accounts and CI pipelines are used and run by developer and ops teams.
Yes	Core infrastructure	Judgment: GitHub is core developer infrastructure that nearly every team relies on.
Yes	Popular tool	Judgment: GitHub is a widely used developer platform; core infrastructure implies yes.
Yes	Exploited in the wild	Aikido Security's Blog: a wave of compromised accounts is pushing a CI secret stealer.
No	Public exploit	Aikido Security's Blog: source describes what the stealer does but does not say exploit code is published.
No	Remote, no login	Aikido Security's Blog: attack relies on compromised accounts; no unauthenticated access is described.
Yes	Full takeover	Aikido Security's Blog: compromised GitHub accounts are used to push malicious code, implying account takeover.
Yes	Secrets exposed	Aikido Security's Blog: the malware is a CI secret stealer, and the post advises what to rotate.
Yes	Supply chain	Aikido Security's Blog: compromised accounts push the stealer to tens of thousands of repositories, reaching CI pipelines.
No	No fix yet	Aikido Security's Blog: source does not mention any patch or fix status; no fix is stated.

Source

Compromised GitHub accounts push CI secret stealer to tens of thousands of repositories ↗ Aikido Security's Blog · 2h ago

First seen 2h ago · 1 source · Full story page · How tiers are decided