Attacker Uses Hijacked GitHub Accounts to Run CI Secret Stealer

An attacker used stolen credentials from 4,837 GitHub accounts to deploy a continuous integration secret stealer into repositories those accounts could write to, according to security software firm Aikido Security. The stealer executed in at least 1,806 repositories, targeting secrets and cloud credentials accessible to automated workflows. SafeDep researchers separately counted 8,093 repositories receiving malicious commits between Tuesday and Thursday. The campaign extracted CI tokens, cloud credentials, and repository histories, while establishing persistence backdoors in Amazon Web Services and Microsoft Azure environments.

Key Facts

How Did the Attacker Compromise Repositories and CI Workflows?

The attacker leveraged stolen credentials from 4,837 GitHub accounts to open test pull requests titled "docs: dependency audit notes" across 61,764 repositories. Where write permissions existed, malicious commits inserted a secret stealer into existing workflows or package postinstall scripts, subsequently deleting execution logs to conceal the compromise.

SafeDep researchers tracked 8,093 repositories that received malicious commits between 12:46 UTC on Tuesday and 04:36 UTC today. In 7,309 of those repositories, the stealer was added to an existing workflow, whilst in 771 it was introduced via an npm postinstall hook. The attacker typically reverted commits within minutes and deleted workflow runs and logs where the payload executed. Furthermore, 10,431 test pull requests were submitted via collaborator or organisation access to repositories the compromised accounts did not own, with 92% remaining open during analysis.

Any account that opened one of the attacker's test pull requests is compromised even if the stealer never ran.

What Secrets and Cloud Environments Were Targeted?

The stealer targeted continuous integration tokens, environment variables, and cloud provider credentials accessible within runner environments. It harvested secrets across AWS, Azure, Google Cloud Platform, and Kubernetes, while copying repository histories and recent workflow artifacts. It also established cloud-level persistence mechanisms designed to survive standard token rotations.

The stealer harvested GitHub Actions secrets, GITHUB_TOKEN values, OIDC runtime tokens, AI service keys, and process memory data. On self-hosted runners, it captured instance metadata, Docker container state, and systemd units. To maintain access, it exchanged OIDC tokens for cloud sessions, generated long-lived IAM access keys on AWS, altered AWS role trust policies to allow access from any AWS account, and added federated identity credentials prefixed with "wfx-ci-" to Azure Active Directory applications. Exfiltration was conducted via HTTP POST requests and Telegram channels.

The stealer is designed to survive credential rotation by altering AWS role trust policies and adding federated identity credentials to Azure applications.

Were Open-Source Software Packages and Modules Affected?

Automated publishing workflows triggered by the compromise affected at least one Packagist package and two Go modules. Although at least 50 compromised users publish open-source packages, security researchers determined that the primary objective of the campaign was harvesting CI secrets rather than spreading malware directly to downstream package consumers.

Packagist package digitalelvis/neuronai-studio version 3.14.3 was published maliciously on Wednesday, executing the stealer if npm install is run within its vendor directory. For Go module github.com/onuragtas/docker-env, versions v1.0.278 and v1.0.280 contained the stealer solely within workflow files, leaving release binaries unaffected. A workflow in Go module github.com/vkuznet/gocurl (pseudo-version v0.0.0-20261111095532-8d5aad0cb0da) also carried the stealer but never ran. Additionally, 28 WebdriverIO repositories received commits authored under the wdio-bot account without impacting releases.

Security researchers found that the threat actor was seeking CI secrets rather than attempting to propagate through open-source packages.

What Should You Do?

• Revoke commit author tokens, OAuth application permissions, SSH keys, and active sessions for compromised accounts, and enforce two-factor authentication (2FA).
• Rotate every secret, environment variable, and cloud role accessible to affected repositories and automated workflows.
• Audit Microsoft Entra ID for unauthorised federated credentials named wfx-ci-*.
• Inspect AWS CloudTrail for AssumeRoleWithWebIdentity or AssumeRole sessions named wfx-*, followed by CreateAccessKey or UpdateAssumeRolePolicy calls.
• Check Google Cloud Platform logs for GenerateAccessToken and SignJwt calls from GitHub workload identity pools, and inspect HashiCorp Vault for JWT logins from the GitHub OIDC issuer.
• Treat any developer machine or runner that executed npm install on an affected commit or within the vendor directory of digitalelvis/neuronai-studio version 3.14.3 as compromised, rotate its keys, and pin version 3.14.2 or earlier.
• Remove versions v1.0.278 and v1.0.280 of Go module github.com/onuragtas/docker-env, and block pseudo-version v0.0.0-20261111095532-8d5aad0cb0da of github.com/vkuznet/gocurl.
• Treat the wdio-bot token as stolen across WebdriverIO repositories.
• Malaysian organisations experiencing CI/CD credential compromise can report incidents to Cyber999 (MyCERT).

Common Questions

What are the primary indicators that a repository was targeted?

Repositories may show test pull requests titled "docs: dependency audit notes" or short-lived branches matching "chore/[a-z0-9]{8}". Because the attacker routinely deleted execution logs and workflow runs, a missing run number on an attacker commit is the most reliable indication that the stealer executed.

Is this campaign attributed to the threat actor behind the October GhostAction attacks?

No direct attribution has been made. While targeted accounts overlapped significantly with GhostAction's October campaign, Aikido Security refrained from attributing the November attacks to the same actor, citing differing infrastructure, tools, and methods, as stolen credentials frequently circulate amongst multiple threat actors.

Does running a standard package installation execute the malicious payload?

A standard composer install of digitalelvis/neuronai-studio version 3.14.3 does not run the stealer, but running npm install inside its vendor directory does. Similarly, Go builds do not execute workflow files, meaning Go module consumers were not directly affected by workflow-only insertions.

Sources and Methodology

This dispatch is based solely on reporting published by The Hacker News on 12 November 2026, incorporating technical findings from security firms Aikido Security and SafeDep. Indicators of compromise are published in the original report.