Attacker Used 4,837 Hijacked GitHub Accounts to Run a CI Secret Stealer in 1,806+ Repositories

First reported by The Hacker News at · Updated · 2 sources

Starting Tuesday, an attacker used stolen credentials for 4,837 GitHub accounts to plant a secret stealer in repositories those accounts could write to, according to Aikido Security, a security software company. The stealer is built to take the secrets and cloud credentials that a repository's CI workflows can reach.

Covered by 2 publishers within 2 hours of the first report.

Summary from The Hacker News.

Reporting2

The Hacker News Attacker Used 4,837 Hijacked GitHub Accounts to Run a CI Secret Stealer in 1,806+ Repositories · info@thehackernews.com (The Hacker News)
Cyber Security News Hackers Hijack 4,837 GitHub Accounts to Target 61,764 Repositories With CI Secret-Stealing Malware · Tushar Subhra Dutta