Attacker Weaponized 4,837 Hijacked GitHub Accounts to Plant CI Secret Stealer in 1,800+ Repositories
RedSide Security November 12, 2026 Cybersecurity 55 views
An attacker used stolen credentials for 4,837 GitHub accounts to plant a CI secret stealer that executed in at least 1,806 repositories, targeting cloud and pipeline credentials.
supply chain
GitHub Actions
account takeover
CI/CD security
credential stuffing
secret stealing
cloud credentials
Continue reading: Attacker Weaponized 4,837 Hijacked GitHub Accounts…
