Thousands of GitHub repos hit with secret-stealing malware
Researchers have uncovered a campaign in which hijacked GitHub accounts spread secret-stealing malware across thousands of repositories. The payload executed in at least 1,806 repos, exfiltrating CI/CD secrets and cloud credentials. Aikido Security, which detected and documented the campaign, said the attackers used the 4,837 compromised accounts to open probe pull requests in 61,764 repositories starting Nov. 10. Around 92% of those pull requests, titled “docs: dependency audit notes,” are still open, which suggests most project owners have not seen them. However, the probes on their own are benign and were performed only to check whether the hijacked accounts had write-access in those repos so that the attackers could follow up with commits that contained the malicious payload: a 1,500-line shell script that collects GitHub Actions secrets, cloud credentials, and API keys for AI services and developer tools. The payload was delivered using at least three methods: modification of exis