4,800+ accounts pushed secret-stealing workflows to 61k+ repos in massive GitHub Actions attack
andersonbcdefg · x · 2026-11-12
Aikido Security disclosed a massive GitHub Actions CI secret-stealing campaign: 4,800+ compromised accounts attempted to push malicious workflows to 61k+ repos. The payload dumps all CI secrets, memory, OIDC and commit secrets, then instantly deletes run logs to cover tracks.
How to check your repos:
- Search for PR titled "docs: dependency audit notes"
- Branches named wfx-docs or chore/
- Commits reading "ci: refresh build cache" or "chore: add ci helper"
- Actions tab showing skipped/missing run numbers
If hit, assume total compromise and rotate ALL secrets and cloud roles immediately.
More from coding & agent
- TerraPulse: a global LiDAR archaeology platform inspired by 48-agent jungle scan of 1,200 km² — RichardsonDx · 2026-11-12
- Mashvisor ships an MCP server for rental property analytics, with setup walkthrough — ahmadhashlamoun · 2026-11-12
- Andrew Ng releases 4 free AI tools on GitHub, including desktop coworker OpenWorker — alex_verem · 2026-11-12
- The fastest way to make $0 with AI: automate outreach before your first client — aryanXmahajan · 2026-11-12
- Slaunt MCP server gives Claude Code 99% memory recall while cutting tokens 31% — karatyma_dev · 2026-11-12
- Managed agents platforms are the new chat-with-a-PDF, says developer — intellectronica · 2026-11-12