Attacker Used 4,837 Hijacked GitHub Accounts to Deploy Secret Stealer in Over 1,800 Repositories

An attacker compromised 4,837 GitHub accounts to plant a secret stealer in at least 1,806 repositories, aiming to exfiltrate secrets and cloud credentials accessible via CI workflows. The attacks, observed on November 12, 2026, began with test pull requests before deploying the malicious code.

Context

On November 12, 2026, an attacker gained access to 4,837 GitHub accounts, allowing them to introduce a secret stealer into at least 1,806 repositories. This method involved sending test pull requests to execute the malicious code. GitHub is widely used for version control and collaboration, making it a prime target for cybercriminals seeking access to sensitive data.

Why it matters

The use of hijacked accounts to deploy malicious software poses significant risks to software security and integrity. This incident highlights vulnerabilities in popular development platforms like GitHub, which are essential for collaboration in the tech industry. The potential for widespread data breaches could affect numerous organizations and their sensitive information.

Implications

This breach could lead to unauthorized access to sensitive information, impacting companies that rely on GitHub for their development processes. Developers and organizations may face increased scrutiny regarding their security practices. The incident may also prompt a reevaluation of security measures across the tech industry, potentially leading to stronger authentication protocols and enhanced monitoring of account activity.

What to watch

Monitoring the response from GitHub and affected organizations will be crucial in the coming weeks. Look for updates on security measures implemented by GitHub to prevent similar attacks. Additionally, organizations may need to review their security protocols and educate their teams on recognizing phishing attempts and securing their accounts.