[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fnudaGltGNiX5dijCC3rEWznKNqWG8K51b84qyYHRx_0":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":16,"status":21,"created_at":22,"published_at":23,"article":24,"tags":28,"podcasts":41,"controls":42},"e1023a71-132b-4ec0-8b7a-6c389453420a","compromised-github-accounts-used-to-steal-cloud-secrets-via-injected-cicd-workflows","f30c0335-6837-48c3-b462-1019b938c121","Compromised GitHub Accounts Used to Steal Cloud Secrets via Injected CI\u002FCD Workflows","Attackers leveraged nearly 4,837 compromised GitHub accounts to inject malicious shell scripts into GitHub Actions workflows, targeting secrets stored in CI\u002FCD pipelines and exfiltrating cloud credentials from over 1,800 repositories. The root issue is a combination of inadequate protection of GitHub Actions secrets and insufficient account security controls (such as weak or reused credentials enabling mass account compromise). This matters because CI\u002FCD pipelines often hold privileged cloud credentials, making them a high-value target that can cascade into full cloud environment compromise. The secondary threat — automatic publishing of malicious packages to Packagist and Go module registries — demonstrates how a single compromised CI\u002FCD environment can poison downstream supply chains at scale.","**Immediate actions:**\n- Rotate all GitHub Actions secrets and cloud credentials that may have been exposed, and audit repository workflow files for unauthorized modifications.\n- Enable mandatory multi-factor authentication (MFA) for all GitHub organization accounts to prevent credential-based account takeover.\n- Restrict GitHub Actions secrets to only the specific workflows and environments that require them using environment protection rules.\n\n**Long-term improvements:**\n- Adopt the principle of least privilege for CI\u002FCD pipeline credentials by using short-lived, scoped tokens (e.g., OIDC-based cloud authentication) instead of long-lived secrets.\n- Implement code review requirements and branch protection rules so no workflow file change can be merged or executed without peer approval.\n- Establish a software supply chain security process that verifies package publishing pipelines and monitors published packages for unexpected changes.\n\n**Detection measures:**\n- Enable audit logging for all GitHub Actions workflow runs and alert on unexpected secret access or workflow file modifications in protected repositories.\n- Monitor cloud provider logs for credential usage from unfamiliar IP addresses or geographic locations that may indicate exfiltrated credential abuse.\n- Subscribe to package registry monitoring services to detect unauthorized or anomalous package publications from your organization's accounts.",[12,13,14,15],"MITRE ATT&CK T1552.001: Credentials in Files","NIST SP 800-53 IA-5: Authenticator Management","NIS2 Article 21(2)(d)","NIST CSF 2.0 DE.CM-01: Continuous Monitoring",{"NIS2 Article 21(2)(d)":17,"MITRE ATT&CK T1552.001: Credentials in Files":18,"NIST CSF 2.0 DE.CM-01: Continuous Monitoring":19,"NIST SP 800-53 IA-5: Authenticator Management":20},"The malicious injection of code into Packagist and Go module registries via compromised pipelines is a supply chain security risk that NIS2's supply chain point directly addresses.","Attackers specifically targeted secrets stored in GitHub Actions workflow files and repository configurations to harvest cloud credentials.","Continuous monitoring of CI\u002FCD workflow executions and secret access patterns would have enabled earlier detection of the credential-exfiltrating shell scripts being injected and run.","Proper authenticator management — including MFA enforcement and rotation of compromised credentials — would have reduced the risk of mass account compromise used to seed this campaign.","published","2026-11-12T23:20:40.147456+00:00","2026-11-12T23:20:40.136+00:00",{"id":7,"url":25,"slug":26,"title":27},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackers-compromise-4-800-github-accounts-to-steal-cloud-credentials\u002F","hackers-compromise-4-800-github-accounts-to-steal-cloud-credentials-ec46d2","Hackers compromise 4,800 GitHub accounts to steal cloud credentials",[29,35],{"id":30,"name":31,"slug":32,"description":33,"color":34},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":36,"name":37,"slug":38,"description":39,"color":40},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[43,47,51],{"slug":44,"name":45,"problem":46},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":48,"name":49,"problem":50},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",{"slug":52,"name":53,"problem":54},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped."]