Security · High impactFan score 93 · Tier S4 sources

Check your GitHub repos: A secret stealer hit tens of thousands of them

Help Net Security · By Mirko Zorz · 3h ago

The Brief · written from 4 sources

An attacker used stolen credentials for 4,837 GitHub accounts to plant a secret stealer in repositories those accounts could write to, according to Aikido Security.
The payload runs in CI and is built to take secrets and cloud credentials; it has pushed into tens of thousands of repositories since November 10.
In more than 1,800 repositories the malware ran and shipped GitHub Actions secrets and cloud credentials to the attacker.

Why it matters

Any repository where the compromised accounts had write access, and where GitHub Actions secrets or cloud credentials are stored, may have leaked those secrets to the attacker.

Who’s affected

Developers and teams whose GitHub repositories use GitHub Actions
Owners of cloud credentials stored as CI secrets

What to do

Check your GitHub repositories for the injected secret stealer payload, as described by Aikido Security and the Help Net Security article
Rotate GitHub Actions secrets and cloud credentials that may have been exposed in CI runs

A threat actor using stolen GitHub credentials has pushed a credential-stealing payload into tens of thousands of repositories since November 10. In more than 1,800 of them, the malware ran and shipped GitHub Actions secrets and cloud credentials to the attacker. Aikido spotted…

Read the full story at helpnetsecurity.com ↗