Attacker Used 4,837 Hijacked GitHub Accounts to Run a CI Secret Stealer in 1,806+ Repositories
Overview
An attacker has exploited stolen credentials from 4,837 GitHub accounts to deploy a secret stealer in over 1,800 repositories. This malicious code is designed to extract sensitive information, including secrets and cloud credentials, from the continuous integration (CI) workflows associated with these repositories. The incident, reported by Aikido Security, raises significant concerns for developers and organizations that rely on GitHub for version control and collaboration. If attackers successfully collect these secrets, they could gain unauthorized access to critical systems and data. This incident underscores the need for users to strengthen their account security and monitor their repositories closely.
Key Takeaways
- Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
- Affected Systems: GitHub accounts, CI workflows, cloud credentials
- Action Required: Users should enable two-factor authentication on their GitHub accounts, regularly review access permissions for repositories, and monitor for any unauthorized changes or access.
- Timeline: Ongoing since October 2023
Original Article Summary
Starting Tuesday, an attacker used stolen credentials for 4,837 GitHub accounts to plant a secret stealer in repositories those accounts could write to, according to Aikido Security, a security software company. The stealer is built to take the secrets and cloud credentials that a repository's CI workflows can reach. It ran in at least 1,806 repositories, where the attacker has likely collected
Impact
GitHub accounts, CI workflows, cloud credentials
Exploitation Status
This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.
Timeline
Ongoing since October 2023
Remediation
Users should enable two-factor authentication on their GitHub accounts, regularly review access permissions for repositories, and monitor for any unauthorized changes or access.
Additional Information
This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.
Related Topics: This incident relates to Critical.