# Compromised GitHub accounts push CI secret stealer to tens of thousands of repositories

Source: [Aikido Security's Blog](https://www.aikido.dev/blog/compromised-github-accounts-push-ci-secret-stealer-to-tens-of-thousands-of-repositories) · 2026-11-12 · Security
Page: https://themorning.dev/story/compromised-github-accounts-push-ci-secret-stealer-to-tens-of-thousands-of-repos-8a587b4d6329e768
Kind: security · Impact: high

## In brief

- A wave of compromised GitHub accounts is pushing a CI secret stealer to tens of thousands of repositories.
- The source article covers how to tell whether you are affected, what the stealer takes, and what to rotate.

## Why it matters

Repositories that receive the stealer can expose CI secrets, so developers need to check their pipelines and rotate any credentials that may have leaked.

## What to do

- Check whether your repositories are affected, using the guidance in the Aikido Security article
- Rotate the CI secrets the article identifies as exposed

## Coverage

- [Compromised GitHub accounts push CI secret stealer to tens of thousands of repositories](https://www.aikido.dev/blog/compromised-github-accounts-push-ci-secret-stealer-to-tens-of-thousands-of-repositories) — Aikido Security's Blog, 2026-11-12

Tags: github, ci-security, supply-chain, malware, secrets

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev