Massive GitHub Actions secret-stealing campaign hits 61k+ repos
A security firm reports 4,800+ compromised accounts attempted to push malicious workflows to over 61,000 repositories to dump CI secrets.
What we know
Aikido Security reports that 4,800+ compromised accounts tried to push malicious workflows to 61k+ repos. The payload dumps all CI secrets, memory, OIDC and commit secrets, then deletes run logs. Developers are advised to rotate secrets.
What people are posting
Posts on X this story draws on. They are individual users' views and have not been verified by Global Eye 24.
@dhkleung
“Massive GitHub Actions CI Secret Stealer”
View post →By the Global Eye 24 desk, with AI assistance. Updated as the story develops. Spot an error? Write to corrections@globaleye24.com.