TL;DR

what: An attacker used stolen credentials for 4,837 GitHub accounts to push a CI secret stealer into repositories those accounts could write to, starting Tuesday, November 10, 2026.

impact: The stealer ran in at least 1,806 repositories, took every secret, token and cloud credential the workflows could reach, and can leave AWS and Azure backdoors that survive token rotation.

fix: Aikido Security and SafeDep advise treating every secret and cloud role available to affected workflows as compromised, revoking the commit author's tokens, OAuth grants, SSH keys and sessions, enabling 2FA, and hunting for wfx-prefixed cloud identities.

who: Any organization whose GitHub repositories grant write access to outside collaborators or org members, especially those using GitHub OIDC federation into AWS, GCP, Azure or Vault, or self-hosted runners.

An attacker holding stolen credentials for 4,837 GitHub accounts spent roughly 40 hours pushing a CI secret stealer into every repository those accounts could write…