--- title: Compromised GitHub accounts push CI secret stealer to... description: A threat actor used stolen GitHub credentials to push a malicious CI workflow into tens of thousands of repositories starting November 10. 4,837 compromised... canonical: https://daily.dev/posts/compromised-github-accounts-push-ci-secret-stealer-to-tens-of-thousands-of-repositories-a4ptui5qo twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Compromised GitHub accounts push CI secret stealer to tens of thousands of repositories | daily.dev og:description: A threat actor used stolen GitHub credentials to push a malicious CI workflow into tens of thousands of repositories starting November 10. 4,837 compromised... og:url: https://daily.dev/posts/compromised-github-accounts-push-ci-secret-stealer-to-tens-of-thousands-of-repositories-a4ptui5qo og:image: https://api.daily.dev/og/posts/a4PtUI5qo.png og:image:alt: Compromised GitHub accounts push CI secret stealer to tens of thousands of repositories og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Compromised GitHub accounts push CI secret stealer to tens of thousands of repositories **[Aikido Security](https://daily.dev/sources/aikido-security)** · 6 min read · 6 upvotes · 0 comments ## Summary A threat actor used stolen GitHub credentials to push a malicious CI workflow into tens of thousands of repositories starting November 10. 4,837 compromised accounts opened probe pull requests in 61,764 repositories, and about 6,500 of them (11%) ran the payload, exposing credentials. The malware steals GitHub Actions secrets, GITHUB_TOKEN, AWS/GCP/Azure credentials, and runner secrets like AI provider API keys. It reached at least one Packagist package and one Go module through automated publishing. The campaign overlaps with October's GhostAction attacks, though attribution to the same actor isn't confirmed. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What GitHub repository indicators show I've been hit by the November CI secret stealer campaign? Look for a 'wfx-docs' branch, a pull request titled 'docs: dependency audit notes', or commits titled 'ci: refresh build cache', 'chore: add ci helper', or 'chore: add dependency audit workflow'. Also check for short-lived branches named 'chore/' followed by eight random characters. The campaign began probing repositories around November 10, 12:45 UTC. _Teams auditing CI pipelines for this kind of compromise swap notes on detection patterns via daily.dev._ ### What does the malicious GitHub Actions payload steal once it runs in a compromised repository? It steals GitHub Actions secrets and variables, the workflow GITHUB_TOKEN, Actions runtime and cache tokens, AWS/GCP/Azure credentials from instance metadata and OIDC, secrets in runner memory including AI provider API keys, plus repository contents, git history, the Actions cache, and build artifacts. Any repository where the payload ran should have every available secret and cloud role treated as compromised. _Developers rotating CI secrets after a suspected breach track remediation steps like these on daily.dev._ ### Which published packages were found to contain this GitHub Actions secret-stealing payload? Packagist package digitalelvis/neuronai-studio version 3.14.3, and Go module github.com/onuragtas/docker-env versions v1.0.278 and v1.0.280. For the Go module, the payload sits only in a GitHub Actions workflow file, not the Go source or release binaries, since Go builds never execute workflow files, though removing the versions is still recommended. _Developers vetting dependencies for supply chain risks follow package-level compromise reports on daily.dev._ ## Similar posts on daily.dev - [Four Credential-Harvesting Campaigns Hit Open Source Ecosystems in Two Weeks](https://daily.dev/posts/four-credential-harvesting-campaigns-hit-open-source-ecosystems-in-two-weeks-gtsbqgosw) · GitGuardian · 1 upvotes · 0 comments - [The vulnerabilities nobody sees in your repository, and how to catch them before they merge](https://daily.dev/posts/the-vulnerabilities-nobody-sees-in-your-repository-and-how-to-catch-them-before-they-merge-qmufkovsn) · Medium · 1 upvotes · 0 comments - [Attackers turn GitHub issues into supply chain campaign against 61 public repos in less than an hour](https://daily.dev/posts/attackers-turn-github-issues-into-supply-chain-campaign-against-61-public-repos-in-less-than-an-hour-qwkbo76ob) · The Register · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#github](https://daily.dev/tags/github), [#github-actions](https://daily.dev/tags/github-actions), [#devsecops](https://daily.dev/tags/devsecops) [View this post on daily.dev](https://daily.dev/posts/compromised-github-accounts-push-ci-secret-stealer-to-tens-of-thousands-of-repositories-a4ptui5qo) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Compromised GitHub accounts push CI secret stealer to tens of thousands of repositories","url":"https://daily.dev/posts/compromised-github-accounts-push-ci-secret-stealer-to-tens-of-thousands-of-repositories-a4ptui5qo","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/compromised-github-accounts-push-ci-secret-stealer-to-tens-of-thousands-of-repositories-a4ptui5qo"},"datePublished":"2026-11-12T02:25:26.852Z","dateModified":"2026-11-13T14:50:58.794Z","description":"A threat actor used stolen GitHub credentials to push a malicious CI workflow into tens of thousands of repositories starting November 10. 4,837 compromised...","image":"https://media.daily.dev/image/upload/s--HRgLpUt6--/f_auto/v1722860399/public/Placeholder%2003","thumbnailUrl":"https://media.daily.dev/image/upload/s--HRgLpUt6--/f_auto/v1722860399/public/Placeholder%2003","isAccessibleForFree":true,"articleSection":"Aikido Security","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Aikido Security","logo":"https://media.daily.dev/image/upload/s--vJDqDYv_--/f_auto,q_auto/v1774959928/logos/aikido-security?_a=BAMAMiWQ0","url":"https://daily.dev/sources/aikido-security"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/compromised-github-accounts-push-ci-secret-stealer-to-tens-of-thousands-of-repositories-a4ptui5qo","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":6},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,github,github-actions,devsecops","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Aikido Security","item":"https://daily.dev/sources/aikido-security"},{"@type":"ListItem","position":3,"name":"Compromised GitHub accounts push CI secret stealer to tens of thousands of repositories"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/compromised-github-accounts-push-ci-secret-stealer-to-tens-of-thousands-of-repositories-a4ptui5qo#faq","mainEntity":[{"@type":"Question","name":"What GitHub repository indicators show I've been hit by the November CI secret stealer campaign?","acceptedAnswer":{"@type":"Answer","text":"Look for a 'wfx-docs' branch, a pull request titled 'docs: dependency audit notes', or commits titled 'ci: refresh build cache', 'chore: add ci helper', or 'chore: add dependency audit workflow'. Also check for short-lived branches named 'chore/' followed by eight random characters. The campaign began probing repositories around November 10, 12:45 UTC. Teams auditing CI pipelines for this kind of compromise swap notes on detection patterns via daily.dev."}},{"@type":"Question","name":"What does the malicious GitHub Actions payload steal once it runs in a compromised repository?","acceptedAnswer":{"@type":"Answer","text":"It steals GitHub Actions secrets and variables, the workflow GITHUB_TOKEN, Actions runtime and cache tokens, AWS/GCP/Azure credentials from instance metadata and OIDC, secrets in runner memory including AI provider API keys, plus repository contents, git history, the Actions cache, and build artifacts. Any repository where the payload ran should have every available secret and cloud role treated as compromised. Developers rotating CI secrets after a suspected breach track remediation steps like these on daily.dev."}},{"@type":"Question","name":"Which published packages were found to contain this GitHub Actions secret-stealing payload?","acceptedAnswer":{"@type":"Answer","text":"Packagist package digitalelvis/neuronai-studio version 3.14.3, and Go module github.com/onuragtas/docker-env versions v1.0.278 and v1.0.280. For the Go module, the payload sits only in a GitHub Actions workflow file, not the Go source or release binaries, since Go builds never execute workflow files, though removing the versions is still recommended. Developers vetting dependencies for supply chain risks follow package-level compromise reports on daily.dev."}}]} ```