Stolen GitHub Accounts Used to Plant CI Secret Stealer in Repositories

Owners of repositories where the stealer ran should revoke tokens and rotate every secret the affected repository can read.

An attacker holding stolen credentials for about 4,800 GitHub accounts probed more than 61,000 repositories with test pull requests, then planted a stealer in those where access allowed it. Aikido Security found signs the stealer ran in at least 1,806 repositories, where secrets and cloud credentials reachable by CI workflows should be treated as exposed. SafeDep counted 8,093 repositories that received malicious commits, a figure that covers changes rather than confirmed execution and likely undercounts public repositories. The stealer harvests tokens, cloud keys and runner memory, and can open AWS roles or Azure federated credentials for lasting access. Owners are advised to revoke tokens and rotate secrets, and StepSecurity traced part of the probing to tokens issued to the Fly.io GitHub app without finding a breach of Fly.io.