[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fiVeudx8wHmvy2N081lCBWJjKzBs7BJirq_wj-IBmTQs":3},{"article":4,"iocs":54,"watch_terms":58,"solutions":59,"lesson":152},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"2d906114-deeb-41c8-83bc-9879d788df63","Hackers Hijack 4,837 GitHub Accounts to Target 61,764 Repositories With CI Secret-Stealing Malware","hackers-hijack-4-837-github-accounts-to-target-61-764-repositories-with-ci-secre-67a810","A threat actor has used stolen GitHub credentials to push a secret-stealing payload into tens of thousands of code repositories. The activity began on November 10, 2026, around 12:45 UTC. It aims at the secrets and cloud keys that sit inside GitHub Actions, the tool many teams use to build and ship code. So far, […] The post Hackers Hijack 4,837 GitHub Accounts to Target 61,764 Repositories With CI Secret-Stealing Malware appeared first on Cyber Security News.","A threat actor used stolen GitHub credentials to inject a secret-stealing malware, named 'wfx', into over 61,000 repositories. The malware targets CI secrets and cloud keys within GitHub Actions, with at least 1,806 repositories running the payload and losing credentials. Researchers noted the attacker's focus on CI secrets rather than a broad supply chain compromise, though some packages were affected.","Hackers hijacked 4,837 GitHub accounts to inject secret-stealing malware into 61,764 repositories.","https:\u002F\u002Fcybersecuritynews.com\u002Fgithub-accounts\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FHackers-Hijack-4837-GitHub-Accounts-to-Target-61764-Repositories-With-CI-Secret-Stealing-Malware.webp","2026-11-12T08:15:03+00:00","2026-11-12T09:00:25.137391+00:00",9,[17,20,23,25,27,29],{"name":18,"type":19},"GitHub Actions","product",{"name":21,"type":22},"CI secrets","technology",{"name":24,"type":22},"cloud keys",{"name":26,"type":19},"npm",{"name":28,"type":19},"Go",{"name":30,"type":19},"Packagist","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":31,"icon":33,"name":34,"slug":35},null,"Malware","malware",[37,42,44,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55],{"type":35,"value":56,"context":57},"wfx","Name of the secret-stealing malware payload.",[18,26,28],{"controls":60,"vendors":148},[61,90,119],{"slug":62,"name":63,"problem":64,"products":65},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[66,74,82],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"slug":91,"name":92,"problem":93,"products":94},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[95,103,111],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"slug":120,"name":121,"problem":122,"products":123},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[124,132,140],{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":141,"vendor_name":142,"vendor_logo":143,"product_slug":144,"product_name":145,"url":146,"description":147},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",[149],{"slug":104,"name":105,"logo_path":106,"roles":150},[151],"affected",{"slug":153,"title":154,"body":155,"framework_refs":156,"framework_notes":162},"stolen-github-credentials-enable-mass-ci-secret-theft-across-61000-repositories","Stolen GitHub Credentials Enable Mass CI Secret Theft Across 61,000 Repositories","Attackers used compromised GitHub account credentials to inject a secret-stealing malware ('wfx') into over 61,000 repositories, targeting CI\u002FCD pipeline secrets and cloud keys embedded in GitHub Actions workflows. The root cause is a combination of weak or reused credentials enabling account takeover and secrets being stored insecurely within CI environments where injected code could harvest them. This matters because CI\u002FCD pipelines have privileged access to production infrastructure, cloud accounts, and downstream packages, meaning stolen CI secrets can cascade into full cloud environment compromises. The incident underscores that protecting source code repositories requires both strong authentication on developer accounts and secrets hygiene within pipeline configurations.",[157,158,159,160,161],"MITRE ATT&CK T1552.001: Credentials in Files","NIST CSF 2.0 PR.AA-03: Users, services, and hardware are authenticated","CIS Control 4: Secure Configuration of Enterprise Assets and Software (v8)","NIS2 Article 21(2)(i)","ISO\u002FIEC 27001:2022 A.8.12: Data leakage prevention",{"NIS2 Article 21(2)(i)":163,"MITRE ATT&CK T1552.001: Credentials in Files":164,"ISO\u002FIEC 27001:2022 A.8.12: Data leakage prevention":165,"NIST CSF 2.0 PR.AA-03: Users, services, and hardware are authenticated":166,"CIS Control 4: Secure Configuration of Enterprise Assets and Software (v8)":167},"This point covers access control and asset management, and the lack of MFA on developer accounts combined with overly permissive CI service account credentials directly enabled the mass compromise.","The malware specifically targeted CI secrets and cloud keys stored within GitHub Actions workflow files and environment variables, matching this technique of harvesting credentials embedded in files.","Controls requiring detection and prevention of unauthorized exfiltration of sensitive information — such as CI secrets and cloud keys — would have flagged or blocked the malware's credential harvesting activity.","The initial compromise relied on stolen GitHub credentials with no evident MFA barrier, meaning stronger authentication requirements would have prevented account hijacking.","Storing long-lived, high-privilege CI secrets directly in GitHub Actions rather than a secrets manager represents a misconfiguration that made credential theft trivially impactful."]