Threat watch / Campaign
GitHub: 4,837 hijacked accounts plant a CI secret stealer in thousands of repositories
Starting on November 10, 2026, an attacker used stolen credentials for 4,837 GitHub accounts to open test pull requests in 61,764 repositories, then planted a stealer in the CI workflows of those it could write to. The stealer takes GitHub Actions secrets, workflow tokens and cloud credentials; the change was reverted within a minute and the run logs usually deleted. Aikido Security, which found it, says every secret and cloud role available to an affected repository's workflows should be treated as compromised.
- Sector
- Many sectors
- Way in
- Stolen credentials
- Product or vendor
- GitHub Actions, digitalelvis/neuronai-studio (Packagist), github.com/onuragtas/docker-env (Go)
- How it happened
- The attacker used stolen GitHub credentials and tokens for 4,837 accounts. Each account first opened a test pull request titled "docs: dependency audit notes" from a wfx-docs branch to check write access, then pushed a workflow change that ran the stealer, reverted it within a minute and usually deleted the run and its logs. How the credentials were obtained is not explained. Aikido notes a strong overlap with the October GhostActions wave: accounts hit in October were about a thousand times more likely to be used in November.[1][2] Checked 12 Nov 2026
- What was stolen
- GitHub Actions secrets and variables, the workflow GITHUB_TOKEN, Actions runtime and cache tokens, AWS, GCP and Azure credentials taken from instance metadata and OIDC, secrets in runner memory and environment variables (including AI provider API keys), repository contents and git history, the Actions cache and build artifacts.[1] Checked 12 Nov 2026
- Who was impacted
- Owners of the 61,764 public repositories that received a test pull request, 10,431 of them through collaborator or organization access, and the projects where the stealer ran: at least 1,806 according to The Hacker News, about 6,500 by Aikido's estimate from a sample. Aikido considers every account that opened a test pull request compromised. Downstream, the stealer reached at least one Packagist package (digitalelvis/neuronai-studio 3.14.3) and one Go module (onuragtas/docker-env v1.0.278 and v1.0.280, payload in a workflow file only). The figures cover only public repositories.[1][2] Checked 12 Nov 2026
- Threat actor
- Not attributed. Aikido does not attribute the November wave to the October GhostActions actor "at this stage", citing different infrastructure, tooling and tradecraft, and notes that stolen credentials often pass to several actors.
Timeline
- From about 12:45 UTC, compromised accounts start opening "docs: dependency audit notes" test pull requests; the first window runs until November 11, 15:00 UTC. [1]
- Aikido Security publishes its analysis: 4,837 accounts, 61,764 repositories probed, the stealer's targets and indicators, and the affected Packagist and Go releases. [1]
- The Hacker News reports that more test pull requests with the same title were opened early on November 12, between 05:04 and 05:38 UTC for the three it checked; it is not clear whether the stealer followed. [2]
- BleepingComputer, citing Aikido, reports that some compromised accounts belong to Fortune 100 organizations, the US General Services Administration, the French government, Nextcloud and WebdriverIO, that about 50 of them appear to have publishing rights on npm, PyPI, Go, crates or Packagist, and that 92% of the test pull requests are still open. [3]