4,837 Hijacked GitHub Accounts Weaponized to Steal CI Secrets Across 1,806+ Repositories
Executive Summary
Executive Summary Beginning November 11, 2026, a threat actor leveraged stolen credentials for 4,837 GitHub accounts to inject a CI secret-stealing payload into over 1,806 repositories, with malicious commits observed across 8,093 public repositories. The attacker opened test pull requests titled 'docs: dependency audit notes' from a branch named wfx-docs to probe write access across 61,764 repositories. Where access was confirmed, a stealer harvested GitHub Actions secrets, OIDC tokens, AWS/Azure/GCP credentials, SSH keys, and package-registry tokens, then exfiltrated data via HTTP POST and Telegram. The attacker also planted persistent backdoors by modifying AWS IAM trust policies and adding Azure AD federated identity credentials prefixed wfx-ci-, surviving credential rotation.
This campaign follows GhostAction's October 2026 wave and signals a maturing supply-chain threat ecosystem where compromised developer identities are weaponized at scale. The overlap between October and November victim accounts—and the rapid downstream reach into npm, Go, Packagist, and PyPI packages—underscores the compounding risk CI/CD pipeline exposure poses to software supply chains globally.
Why This Matters Now
Why This Matters NowCI/CD pipelines have become the highest-value lateral movement corridors in cloud-native organizations. With attackers now automating secret harvesting across tens of thousands of repositories, rotating secrets alone is insufficient—persistent IAM backdoors in AWS and Azure AD mean compromised blast radius extends far beyond the initial breach window, demanding continuous cloud posture monitoring and egress policy enforcement.
Attack Path Analysis
Attack Path AnalysisThe attacker leveraged 4,837 stolen GitHub account credentials to open test pull requests across tens of thousands of repositories, then injected a CI secret-stealer workflow into writable repositories. Once the stealer executed inside GitHub Actions runners, it harvested CI secrets, cloud credentials, and OIDC tokens, exchanged them for long-lived cloud sessions across AWS, Azure, and GCP, established persistent backdoors by rewriting IAM trust policies and adding federated identity credentials, and exfiltrated all collected data via HTTP POST to attacker-controlled servers and a Telegram channel before reverting commits to erase evidence.
Kill Chain Progression
Kill Chain ProgressionThis analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
DescriptionThe attacker used stolen credentials for 4,837 GitHub accounts to authenticate and open test pull requests (titled 'docs: dependency audit notes') from wfx-docs branches across 61,764 repositories. Where write access was confirmed, malicious commits were pushed injecting a secret-stealer into existing CI workflow files or as an npm postinstall hook. The initial credential acquisition method is unattributed but overlaps with accounts compromised in a prior GhostAction October wave.
MITRE ATT&CK® Techniques
MITRE ATT&CK® TechniquesValid Accounts
Supply Chain Compromise: Compromise Software Dependencies and Development Tools
Unsecured Credentials: Credentials In Files
Serverless Execution
Account Manipulation: Additional Cloud Credentials
Indicator Removal: File Deletion
Exfiltration Over C2 Channel
Use Alternate Authentication Material: Application Access Token
Potential Compliance Exposure
Potential Compliance ExposureMapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev 5 – Authenticator Management, Protection of Information at Rest, Audit Record Generation
Control ID: IA-5, SC-28, AU-12
PCI DSS 4.0 – User Identification and Authentication Management, System/Application Account Management, Automated Log Anomaly Detection
Control ID: Requirement 8.2, 8.6, 10.7
CISA Zero Trust Maturity Model 2.0 – Continuous Identity Validation and Workload Integrity Monitoring
Control ID: Identity Pillar – Visibility & Analytics, Application Workload Pillar – Automation & Orchestration
NIS2 Directive – Risk Management Measures – Supply Chain Security and Incident Reporting
Control ID: Article 21(2)(a)(b)(e), Article 23
DORA (EU 2022/2554) – ICT Supply Chain Risk Management and Major Incident Reporting
Control ID: Article 9 – ICT Security, Article 19 – Reporting of Major ICT Incidents
ISO/IEC 27001:2022 – Supply Chain and Cloud Security Controls in Secure SDLC
Control ID: A.8.8 – Management of Technical Vulnerabilities, A.5.23 – Information Security for Use of Cloud Services, A.8.25 – Secure Development Life Cycle
Sector Implications
Sector ImplicationsIndustry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
CI/CD pipeline compromise across 1,806+ repositories exposes software firms to supply-chain credential theft, with OIDC token abuse enabling persistent cloud access surviving secret rotation per validated egress and segmentation controls.
Information Technology/IT
Hijacked GitHub accounts targeting AWS, Azure, GCP, Kubernetes, and npm credentials threaten IT organizations' multicloud environments, requiring Zero Trust segmentation and egress policy enforcement mapped to NIST.800-53.SC-7 and PCI.4.0.3.5.1.
Financial Services
Long-lived AWS IAM key creation and Azure AD federated credential backdoors from this supply-chain infostealer directly risk financial services' cloud infrastructure, violating PCI.4.0.4.2.1 and NIST.CSF.PR.DS-5 compliance mandates.
Computer/Network Security
Security vendors using automated CI pipelines and publishing to npm, PyPI, or Packagist face reputational and operational risk as stolen workflow secrets enable downstream compromise of security tooling distribution channels.
Sources
Sources- Attacker Used 4,837 Hijacked GitHub Accounts to Run a CI Secret Stealer in 1,806+ Repositorieshttps://thehackernews.com/2026/11/4837-hijacked-github-accounts-ran-ci.htmlVerified
- Aikido Security: Compromised GitHub Accounts Push CI Secret Stealer to Tens of Thousands of Repositorieshttps://www.aikido.dev/blog/compromised-github-accounts-push-ci-secret-stealer-to-tens-of-thousands-of-repositoriesVerified
- SafeDep: GitHub Actions WFX Credential Stealer Analysishttps://safedep.io/blog/github-actions-wfx-credential-stealerVerified
- Packagist: digitalelvis/neuronai-studio Package Flagged as Malware (v3.14.3)https://packagist.org/packages/digitalelvis/neuronai-studioVerified
- The Hacker News: GhostAction Compromises About 1900 GitHub Accounts (October Wave)https://thehackernews.com/2026/10/ghostaction-compromises-about-1900.htmlVerified
- CISA: Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
- GitHub Security Advisory: Best Practices for Securing GitHub Actions Workflowshttps://docs.github.com/en/actions/security-guides/security-hardening-for-github-actionsVerified
Frequently Asked Questions
Frequently Asked QuestionsCloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is directly relevant because the attacker's ability to move from compromised CI runner identities into cloud environments depended on unrestricted cross-account reachability and uncontrolled egress paths. By enforcing workload-level segmentation and identity-scoped access boundaries across AWS, Azure, and GCP, Aviatrix would likely have reduced the blast radius from a CI-level credential theft into a full multi-cloud persistent backdoor campaign.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: CNSF-enforced boundaries around CI runner workloads would likely reduce the reachability of compromised runner environments into broader cloud infrastructure, limiting how far a poisoned workflow could reach beyond its immediate execution context.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation would likely constrain the scope of cloud-level access achievable after OIDC token exchange by limiting which services and roles a CI workload identity could reach, reducing the attacker's ability to escalate from ephemeral runner credentials into durable multi-cloud administrator-level sessions.
Control: East-West Traffic Security
Mitigation: East-west enforcement would likely reduce the attacker's ability to traverse cloud account boundaries using rewritten role trust policies, constraining cross-account reachability and limiting how freely compromised credentials could be used to assume roles or access workloads in adjacent cloud environments.
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility and control would likely expose anomalous outbound connections from CI runner workloads to unexpected external IP addresses and consumer messaging infrastructure, giving operators the observability needed to identify and constrain attacker-controlled communication channels before full data transfer completes.
Control: Egress Security & Policy Enforcement
Mitigation: Egress security and policy enforcement would likely constrain the volume and destination reach of outbound data transfers from CI runner environments, reducing the attacker's ability to reliably deliver large credential and artifact payloads to hardcoded external endpoints without hitting an enforced egress boundary.
Where prior CNSF segmentation and egress controls had been in place, residual impact would likely be scoped to a smaller subset of cloud environments, as cross-account role assumption paths and uncontrolled egress would have constrained how many cloud accounts the attacker could have durably backdoored before detection.
Impact at a Glance
Affected Business Functions
- CI/CD Pipeline Integrity and Software Build Systems
- Cloud Credential and IAM Secret Management
- Open Source Package Publishing and Software Supply Chain
- Developer Workstation and Repository Security
Estimated downtime: 3 days
Estimated loss: N/A
Confirmed exfiltration of CI/CD secrets and cloud credentials across at least 1,806 repositories, including GitHub Actions secrets and variables, GITHUB_TOKEN values, OIDC and Actions runtime tokens, AWS access keys and IAM role credentials, Azure AD tokens and federated identity credentials, GCP service account tokens, Kubernetes configuration and credentials, SSH private keys, npm and PyPI publishing tokens, AI service API keys, repository source code and last 100 commits per affected repository, recent workflow artifacts, Docker container state and systemd unit configurations on self-hosted runners, and cloud instance metadata credentials. The stealer also persisted long-lived backdoors in AWS by creating IAM access keys and rewriting role trust policies, and in Azure AD by injecting federated credentials prefixed wfx-ci-, allowing attacker re-entry even after credential rotation. At least 50 compromised users are known package publishers across npm, Go, Packagist, PyPI, and crates.io ecosystems. One Packagist package (digitalelvis/neuronai-studio v3.14.3) and two Go module versions were confirmed malicious, with downstream consumer exposure possible. Developer machines that ran npm install on affected commits should be treated as fully compromised, expanding data exposure beyond repository boundaries to local developer environments.
Recommended Actions
Key Takeaways & Next Steps
- • Apply Zero Trust Segmentation (ZTMM.Network, NIST.800-53.AC-6) to enforce least-privilege identity-based policies on CI/CD service identities and GitHub Actions OIDC integrations, ensuring no runner or workflow role can assume cloud permissions beyond its minimum required scope, preventing the OIDC token exchange escalation observed in this attack.
- • Deploy Egress Security & Policy Enforcement (ZTMM.Data, NIST.CSF.PR.DS-5) with FQDN and IP-based egress filtering on CI runner outbound traffic to block unauthorized HTTP POST data exfiltration to attacker-controlled IPs (194.150.166[.]244, 18.143.168[.]96, 153.75.82[.]159) and unapproved Telegram endpoints before secrets leave the environment.
- • Enable Multicloud Visibility & Control (ZTMM.CrossCutting.Visibility, NIST.800-53.AU-6) to baseline and monitor CI workflow traffic patterns, triggering alerts on anomalous outbound connections, mass pull request creation from new branches, rapid commit-then-revert sequences, and unexpected AssumeRoleWithWebIdentity or CreateAccessKey API calls across AWS, Azure, and GCP.
- • Leverage Cloud Firewall (ACF) capabilities (ZTMM.Network, NIST.800-53.SC-7) to enforce outbound internet egress controls on cloud workloads and CI runners, restricting egress to approved destinations only and surfacing AI-assisted discovery of novel exfiltration traffic patterns such as bulk credential file transfers or unexpected Telegram API calls.
- • Activate Inline IPS with Suricata signatures (ZTMM.Data, NIST.800-53.SI-4) on egress paths to detect and block known malicious payload patterns associated with the wfx stealer script (SHA-256: 89695abb392d5cfd4972672961e644bb46baa98aa1ed7173c2a2816c762735cf), CI credential harvesting tool signatures, and HTTP POST exfiltration attempts to flagged IPs, complemented by Cloud Native Security Fabric distributed policy enforcement to provide real-time inline control across all cloud network paths.
