Attacker Used 4,837 Hijacked GitHub Accounts to Run a CI Secret Stealer in 1,806+ Repositories

An attacker used stolen credentials from thousands of hijacked GitHub accounts to plant a secret-stealing script across thousands of repositories. According to security researchers, the malicious workflows and npm hooks collected sensitive cloud credentials, authentication tokens, and secrets from vulnerable CI environments before the commits were typically reverted. Open article →