[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fY4a9MDMg2nJpbgh9UfE1PiQ6aphTehHgrnxvT4REEkw":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"036f60c2-874a-48e1-aa79-f570476ac742","stolen-github-credentials-enable-mass-ci-secret-theft-across-61000-repositories","2d906114-deeb-41c8-83bc-9879d788df63","Stolen GitHub Credentials Enable Mass CI Secret Theft Across 61,000 Repositories","Attackers used compromised GitHub account credentials to inject a secret-stealing malware ('wfx') into over 61,000 repositories, targeting CI\u002FCD pipeline secrets and cloud keys embedded in GitHub Actions workflows. The root cause is a combination of weak or reused credentials enabling account takeover and secrets being stored insecurely within CI environments where injected code could harvest them. This matters because CI\u002FCD pipelines have privileged access to production infrastructure, cloud accounts, and downstream packages, meaning stolen CI secrets can cascade into full cloud environment compromises. The incident underscores that protecting source code repositories requires both strong authentication on developer accounts and secrets hygiene within pipeline configurations.","**Immediate actions:**\n- Rotate all CI\u002FCD secrets, cloud API keys, and tokens stored in GitHub Actions secrets or environment variables immediately if any repository may have been exposed.\n- Enable mandatory multi-factor authentication (MFA) for all GitHub organization members and audit accounts for recent unauthorized access.\n- Audit GitHub Actions workflow files across repositories for unexpected or injected steps referencing unknown external actions.\n\n**Long-term improvements:**\n- Migrate CI secrets to dedicated secrets management solutions (e.g., HashiCorp Vault, AWS Secrets Manager) with short-lived, scoped credentials instead of long-lived tokens.\n- Enforce branch protection rules and require code review approvals before workflow changes can be merged or executed.\n- Adopt the principle of least privilege for all CI\u002FCD service accounts, limiting each pipeline's access to only the resources it strictly requires.\n\n**Detection measures:**\n- Implement continuous monitoring and alerting on GitHub audit logs for unusual repository modifications, new workflow file commits, or bulk changes across repositories.\n- Deploy secret scanning tools (e.g., GitHub Advanced Security, truffleHog) to automatically detect and block secrets committed to repositories.\n- Monitor cloud provider audit logs for anomalous API calls that may indicate harvested credentials are being used in production environments.",[12,13,14,15,16],"MITRE ATT&CK T1552.001: Credentials in Files","NIST CSF 2.0 PR.AA-03: Users, services, and hardware are authenticated","CIS Control 4: Secure Configuration of Enterprise Assets and Software (v8)","NIS2 Article 21(2)(i)","ISO\u002FIEC 27001:2022 A.8.12: Data leakage prevention",{"NIS2 Article 21(2)(i)":18,"MITRE ATT&CK T1552.001: Credentials in Files":19,"ISO\u002FIEC 27001:2022 A.8.12: Data leakage prevention":20,"NIST CSF 2.0 PR.AA-03: Users, services, and hardware are authenticated":21,"CIS Control 4: Secure Configuration of Enterprise Assets and Software (v8)":22},"This point covers access control and asset management, and the lack of MFA on developer accounts combined with overly permissive CI service account credentials directly enabled the mass compromise.","The malware specifically targeted CI secrets and cloud keys stored within GitHub Actions workflow files and environment variables, matching this technique of harvesting credentials embedded in files.","Controls requiring detection and prevention of unauthorized exfiltration of sensitive information — such as CI secrets and cloud keys — would have flagged or blocked the malware's credential harvesting activity.","The initial compromise relied on stolen GitHub credentials with no evident MFA barrier, meaning stronger authentication requirements would have prevented account hijacking.","Storing long-lived, high-privilege CI secrets directly in GitHub Actions rather than a secrets manager represents a misconfiguration that made credential theft trivially impactful.","published","2026-11-12T09:20:57.702455+00:00","2026-11-12T09:20:57.681+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fcybersecuritynews.com\u002Fgithub-accounts\u002F","hackers-hijack-4-837-github-accounts-to-target-61-764-repositories-with-ci-secre-67a810","Hackers Hijack 4,837 GitHub Accounts to Target 61,764 Repositories With CI Secret-Stealing Malware",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":38,"name":39,"slug":40,"description":41,"color":42},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[45,49,53],{"slug":46,"name":47,"problem":48},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":50,"name":51,"problem":52},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",{"slug":54,"name":55,"problem":56},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped."]