Aikido links hijacked GitHub accounts to CI secret stealer

An attacker leveraged credentials for 4,837 hijacked GitHub accounts to deploy a secret stealer in repositories those accounts could write to, according to Aikido Security. The stealer is designed to exfiltrate secrets and cloud credentials accessible by CI workflows and ran in at least 1,806 public repositories. The entry method involved test pull requests titled docs: dependency audit notes, opened from branches named wfx-docs to probe write access across tens of thousands of repos.

SafeDep’s analysis counted 8,093 repositories receiving malicious commits between 12:46 UTC on Tuesday and 04:36 UTC today, covering all repositories that received malicious commits (not only where the stealer ran). In 7,309 of those, the stealer was added to an existing workflow; in 771 cases it arrived as an npm postinstall hook that runs during npm install.

The attacker typically reverted changes within minutes and deleted logs where the stealer ran; where active, the stealer’s exfiltration was orchestrated via HTTP POST to listed addresses or Telegram, with a sample showing several IPs including 194.150.166[.]244:8080, 18.143.168[.]96:8080 and 153.75.82[.]159:8080. The campaign appears to target CI secrets rather than spreading through packages, with evidence spanning multiple ecosystems (Go, npm, Packagist, PyPI, and more).

Aikido noted that accounts hit this week overlap with GhostAction’s October wave, but attribution to the same actor remains unclear. The article also notes a correction: a third server and a Telegram channel were involved, and some changes could persist longer than initially stated. The findings reference multiple analyses, including SafeDep’s technical report.