Stolen logins for 4,837 GitHub accounts used to steal pipeline secrets
Original title: Hackers Compromise Nearly 5,000 GitHub Accounts to Steal Secrets From Software Development Pipelines
From November 10, malicious workflows probed 61,764 repositories, with credential theft seen in at least 1,806.
Aikido says attackers used stolen GitHub credentials for 4,837 accounts, opening pull requests titled docs: dependency audit notes to test write access. They then injected one of three workflow or postinstall payloads, often reverting them within a minute and deleting run logs. The stealer collects Actions secrets, runner and cloud credentials, and AI-service credentials, and can change AWS trust policies or Azure federated identity credentials. At least 50 compromised users publish packages on npm, Go, Packagist, PyPI, or crates.
Unconfirmed: Aikido withholds attribution to the GhostAction actor because infrastructure, tooling, and tradecraft differ.
- GitHub searches found 61,839 matching pull requests between November 10 and November 11.
- About 92% of those pull requests were still open when researchers checked.
- Exfiltration indicators are HTTP POST to 194.150.166.244:8080 and 18.143.168.96:8080.
- Named affected releases include digitalelvis/neuronai-studio 3.14.3 and docker-env v1.0.278 and v1.0.280.
- Aikido notes overlap with October GhostAction activity but withholds attribution.
Impact: CI secrets, cloud tokens, and repository credentials stolen
- 1.Treat workflow-accessible secrets and cloud roles as compromised where a malicious run executed.
- 2.Investigate deleted runs, suspicious commits, and cloud identity changes, not only current files.
- 3.Look for pull requests titled docs: dependency audit notes and branches named wfx-docs.
- ATT&CK
- T1078 Valid AccountsT1098 Account ManipulationT1552.005 Cloud Instance Metadata APIT1041 Exfiltration Over C2 Channel
- Products
- GitHubGitHub Actions
- Organizations
- Aikido
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 18.143.168.96 | s deployment. Aikido lists 194.150.166[.]244:8080/exfil and 18.143.168[.]96:8080/exfil as network indicators. Missing artifacts or ca |
| ipv4 | 194.150.166.244 | OST as the enabled channel in this deployment. Aikido lists 194.150.166[.]244:8080/exfil and 18.143.168[.]96:8080/exfil as network indi |
From the original article
3 min read at gbhackers.com
Attackers used stolen GitHub credentials belonging to 4,837 accounts to probe 61,764 repositories in a campaign targeting software development secrets and cloud access. Beginning November 10, the operation injected malicious workflows into accessible repositories, with evidence of credential exfiltration from at least 1,806 repositories. At least 50 compromised users publish packages across npm, Go, Packagist, […]
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.