Massive GitHub Account Hijacking Exposes 61,000+ Repositories to Secret-Stealing Malware
A widespread attack has compromised thousands of GitHub accounts, injecting malware into over 61,000 repositories to steal sensitive CI secrets and cloud credentials.
A sophisticated threat actor has successfully hijacked at least 4,837 GitHub accounts, using them to inject secret-stealing malware into a staggering 61,764 code repositories. The malicious activity, which began around November 10, 2026, specifically targets the sensitive secrets and cloud keys commonly stored within GitHub Actions, a vital tool for many development teams.
The attack chain begins with the compromised accounts opening "probe pull requests" to verify write access to repositories. Researchers at Aikido identified that over 61,839 such pull requests were opened between November 10 and November 11, with a significant portion (10,431) targeting repositories the attacker did not directly own, leveraging collaborator or organizational access. Alarmingly, about 92% of these probe requests remain open, indicating that most repository owners have yet to detect the intrusion.
Once write access is confirmed, the attacker proceeds to inject the actual payload through one of three methods. These include modifying existing workflow files by adding extensive code, embedding a hidden script with a postinstall hook in package.json for npm packages, or creating a new workflow file in a temporary branch. To further evade detection, the attacker implements a cleanup phase, reverting changes and deleting workflow run logs within a minute, leaving only a missing run number in the workflow history as a potential trace.
Of the repositories targeted, at least 1,806 are confirmed to have executed the payload, leading to the loss of credentials. The impact is amplified as at least 50 of the compromised account holders are also package publishers on platforms like npm, Go, Packagist, and PyPI, increasing the risk for downstream users. While the attacker's primary goal appears to be the theft of CI secrets rather than a broad supply chain compromise, the payload did successfully infiltrate one Packagist package and one Go module via automated publishing triggers.
The malware, identified as "wfx," operates in four distinct stages: collect, escalate, persist, and exfiltrate. It systematically gathers GitHub Actions secrets, runtime tokens, cloud credential files, shell histories, and keys for AI tools. It also attempts to extract tokens from running processes' memory. The collected information is then used to escalate privileges within cloud environments, such as swapping GitHub OIDC tokens for AWS, Google Cloud, and Azure sessions, and creating persistent access keys.
To ensure persistence, the malware employs tactics like forging "success" status checks to bypass branch protection rules, modifying AWS roles for broader access, and adding new federated identity credentials in Azure. This mirrors techniques seen in previous supply chain attacks, such as the Shai-Hulud npm worm. Exfiltration of the stolen data is primarily conducted via HTTP POST requests to two identified servers, though other channels within the script were disabled.
Security researchers urge defenders to immediately search for specific branches, pull request titles, and commit messages associated with the attack. If the payload is found to have run, all secrets and cloud roles accessible to the compromised workflow should be considered exposed and rotated. This includes revoking hijacked GitHub tokens, reviewing audit logs for suspicious activity, and implementing security best practices like phishing-resistant sign-in methods and limiting workflow permissions.
This incident underscores the persistent threat to software supply chains and the critical importance of securing development workflows. The scale of the compromise, affecting tens of thousands of repositories and potentially exposing sensitive cloud infrastructure credentials, highlights the need for enhanced vigilance and robust security measures within the developer ecosystem.