On Tuesday, a threat actor leveraged stolen credentials for 4,837 GitHub accounts to plant a secret‑stealing tool in repositories that those accounts could write to, security‑software firm Aikido Security said.
The attacker used the compromised login details to obtain write access to a large number of projects on GitHub, then inserted malicious code that is executed during the repositories’ continuous‑integration (CI) workflows.
The malicious component is designed to capture secrets and cloud credentials that CI pipelines can reach, allowing the attacker to harvest authentication tokens, API keys and other sensitive configuration data stored in the affected repositories.
According to Aikido Security, the secret stealer was active in at least 1,806 repositories, where the attacker has likely collected the targeted credentials and other confidential information.
GitHub hosts millions of open‑source and private projects, and many development teams rely on CI systems that run with elevated privileges. Security experts stress that the reuse of passwords across services and the lack of multi‑factor authentication can enable large‑scale credential theft such as this incident.
<small>Source: The Hacker News — read the original story there.</small>
