[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fiXGxP2Oqj5EKn9EkbngqU9j9R9cbr-b-c9sAhauxBOM":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":50},"e95595b8-835a-4a55-a35d-0085e9e95692","stolen-github-credentials-enable-mass-ci-secret-theft-across-tens-of-thousands-of-repositories","96097682-989c-4b67-9bc0-44b7b840bfd5","Stolen GitHub Credentials Enable Mass CI Secret Theft Across Tens of Thousands of Repositories","Attackers leveraged compromised GitHub credentials to inject malicious workflow files into tens of thousands of repositories, silently exfiltrating GitHub Actions secrets and cloud credentials during CI\u002FCD pipeline execution. The attack propagated further through automated triggers in published package ecosystems such as Packagist and Go modules, amplifying the blast radius into downstream consumers. This illustrates how a single set of stolen credentials can weaponize a trusted software supply chain at massive scale. Secrets stored in CI\u002FCD environments are high-value targets precisely because they often carry privileged access to cloud infrastructure, container registries, and deployment systems.","**Immediate actions:**\n- Rotate all GitHub Actions secrets and cloud credentials that may have been exposed in affected repositories immediately.\n- Audit recent workflow file changes across your repositories for unexpected additions or modifications to `.github\u002Fworkflows\u002F`.\n- Enable GitHub's secret scanning and push protection to detect and block credential exposure in real time.\n\n**Long-term improvements:**\n- Enforce multi-factor authentication (MFA) on all GitHub accounts and restrict repository write access using the principle of least privilege.\n- Adopt short-lived, scoped credentials (e.g., OIDC-based cloud authentication) in CI\u002FCD pipelines instead of storing long-lived static secrets.\n- Pin third-party GitHub Actions and package dependencies to verified commit SHAs or digests rather than mutable tags to prevent tampered versions from executing.\n\n**Detection measures:**\n- Implement continuous monitoring of CI\u002FCD pipeline logs for unexpected secret access events or anomalous workflow executions.\n- Subscribe to security advisories for package registries (Packagist, Go modules) and verify the integrity of ingested dependencies against known-good checksums.\n- Set up alerting for new or modified workflow files introduced by accounts outside your normal contributor set.",[12,13,14,15,16],"MITRE ATT&CK T1195.001: Supply Chain Compromise: Compromise Software Dependencies and Development Tools","NIST SP 800-53 SA-12: Supply Chain Protection","CIS Control 4: Secure Configuration of Enterprise Assets and Software","NIS2 Article 21(2)(d)","NIST CSF 2.0 DE.CM-09: Monitoring of Computing Hardware, Software, and Services",{"NIS2 Article 21(2)(d)":18,"NIST SP 800-53 SA-12: Supply Chain Protection":19,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":20,"NIST CSF 2.0 DE.CM-09: Monitoring of Computing Hardware, Software, and Services":21,"MITRE ATT&CK T1195.001: Supply Chain Compromise: Compromise Software Dependencies and Development Tools":22},"This point mandates supply chain security measures, directly applicable because the attack propagated through trusted package registries and CI\u002FCD pipelines relied upon by many organizations.","This control requires organizations to protect against supply chain threats, which would have driven scrutiny of third-party workflow actions and package dependencies before they were ingested.","Enforcing least-privilege repository permissions and restricting who can modify workflow files would have limited an attacker's ability to inject malicious CI configuration at scale.","Continuous monitoring of CI\u002FCD pipeline activity and workflow file changes would have detected the unauthorized injection of malicious payloads into repositories early in the campaign.","The attackers injected malicious workflow payloads into repositories and published packages, directly compromising the software supply chain that downstream consumers trust.","published","2026-11-12T03:20:21.968281+00:00","2026-11-12T03:20:21.953+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.aikido.dev\u002Fblog\u002Fcompromised-github-accounts-push-ci-secret-stealer-to-tens-of-thousands-of-repositories","compromised-github-accounts-push-ci-secret-stealer-to-tens-of-thousands-of-repos-8f22bc","Compromised GitHub accounts push CI secret stealer to tens of thousands of repositories",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":38,"name":39,"slug":40,"description":41,"color":42},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[44],{"id":45,"date":46,"edition":47,"title":48,"audio_url":49},"542544c8-b14a-41e4-abbe-d2a71e775a1d","2026-11-12","morning","ThreatNoir Morning Brief — November 12","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-11-12\u002Fthreatnoir-morning-brief-2026-11-12.mp3",[51,55,59],{"slug":52,"name":53,"problem":54},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":56,"name":57,"problem":58},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",{"slug":60,"name":61,"problem":62},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped."]