GitHub CI Secret Stealer Attack November 2026: 4,837 Accounts Hijacked, 1,806 Repositories Compromised

Image: GitHub (via Wikimedia Commons) — the GitHub logo. The attack targeted GitHub accounts and CI workflows.

UPDATE — 12 November 2026, 15:30 IST: A second analysis by SafeDep widens the scale of this attack: 8,093 public repositories received malicious commits between 12:46 UTC on 10 November and 04:36 UTC today — that counts every repository that received a malicious commit, while Aikido's 1,806 is the smaller subset where the stealer actually ran. In 7,309 of those repositories the stealer was added to an existing workflow; in 771 it arrived as an npm postinstall hook, which also runs on a developer's machine during npm install. The same analysis found a third exfiltration server (153.75.82.159:8080) and a Telegram channel — about a fifth of sampled payload commits used Telegram only — and corrected the earlier picture: some malicious changes were left in place for longer, not all reverted within a minute. New checks if you were hit: look for federated identity credentials named wfx-ci-* in Entra ID and wfx-* sessions in AWS CloudTrail — the stealer can plant backdoors that survive credential rotation. Also newly confirmed: a second Go module (github.com/vkuznet/gocurl, pseudo-version v0.0.0-20261111095532-8d5aad0cb0da) and 28 WebdriverIO repositories hit via the wdio-bot account, whose token should be treated as stolen. Block Packagist digitalelvis/neuronai-studio v3.14.3 and pin v3.14.2 or earlier. (Sources: The Hacker News, 12 November 2026, reporting SafeDep's second analysis; Aikido Security.)

TL;DR — Attackers used stolen credentials from 4,837 GitHub accounts to plant a secret-stealing workflow in tens of thousands of repositories from 10 November 2026. The payload ran in at least 1,806 repositories, harvesting CI secrets and cloud credentials — and new probe pull requests were still appearing on the morning of 12 November. If a "docs: dependency audit notes" pull request appeared in any repository you can write to, treat your secrets as compromised and rotate them now.

📌 KEY HIGHLIGHTS

• 4,837 compromised GitHub accounts opened probe pull requests in 61,764 repositories, according to Aikido Security's research published 12 November 2026.
• The secret-stealing payload ran in at least 1,806 repositories, and the attacker deleted workflow runs and logs to hide the theft.
• The campaign was still active on the morning of 12 November — new probe pull requests were spotted hours after Aikido's search ended.
• Malicious code also reached a Packagist package (digitalelvis/neuronai-studio 3.14.3) and a Go module (github.com/onuragtas/docker-env v1.0.278 and v1.0.280).
• Anyone whose account opened one of the attacker's test pull requests is compromised, even if the stealer never ran, Aikido says.

What happened?

Starting at about 12:45 UTC on Tuesday 10 November 2026, an attacker began using stolen GitHub credentials to push a malicious workflow payload into repositories those accounts could write to. Security firm Aikido Security, which uncovered the campaign, reports that 4,837 compromised accounts opened probe pull requests in 61,764 repositories — and GitHub search returned 61,839 matching pull requests between 10 November 12:45 UTC and 11 November 15:00 UTC.

Each attack started with a pull request titled "docs: dependency audit notes", opened from a branch named wfx-docs, to test whether the account could write to the repository. Where the account had write access, the attacker pushed the stealer — then reverted the change within a minute and usually deleted the workflow run and its logs.

The campaign did not stop there. The Hacker News, checking GitHub after Aikido's search had ended on Wednesday, found more pull requests with the same title opened early on Thursday 12 November — three checked, opened between 05:04 and 05:38 UTC, all from wfx-docs branches. The attack is ongoing.

How the attack works — and what it steals

The payload is a single shell script of about 1,500 lines, injected into an existing workflow by a commit titled "ci: refresh build cache". Two other commit titles were also used: "chore: add ci helper", which introduces a .ci-xxxxxx.sh script through an npm postinstall hook, and "chore: add dependency audit workflow", which creates a workflow on a temporary chore/xxxxxxxx branch.

Once it runs, the stealer collects credentials from every source on the runner — GitHub Actions secrets and variables, the workflow's GITHUB_TOKEN, OIDC and Actions runtime tokens, keys for AI services, and secrets held in the memory of the runner's own processes. Where it ran, every secret and cloud role available to the repository's workflows should be treated as compromised.

Indicator	What to look for
Pull request title	"docs: dependency audit notes" from a wfx-docs branch
Commit titles	"ci: refresh build cache", "chore: add ci helper", "chore: add dependency audit workflow"
Missing run numbers	A gap in workflow run numbers — the attacker deleted runs and logs
Exfiltration IPs	194.150.166.244:8080/exfil and 18.143.168.96:8080/exfil
Malicious releases	Packagist digitalelvis/neuronai-studio 3.14.3; Go module github.com/onuragtas/docker-env v1.0.278 and v1.0.280

The figures cover only the public repositories Aikido could see, so the true scale may be larger. At least 50 of the compromised users publish packages for ecosystems including npm, Go, Packagist, PyPI or crates — and automated publishing triggers carried the malicious code into at least one Packagist package and one Go module. Any machine that installed or opened Packagist digitalelvis/neuronai-studio version 3.14.3 should be treated as compromised.

Illustrative image: code on a developer's screen. Photo: Unsplash.

Why it matters for developers everywhere

GitHub is where most of the world's software is built, and CI secrets are the keys to the kingdom: cloud credentials, deployment tokens and API keys that can open production systems far beyond a single repository. A stealer that runs inside a trusted workflow inherits all of that access — and because the attacker wipes the logs, victims may never know their secrets were taken.

The compromised accounts overlap with those hit in the GhostAction wave in October 2026, when stolen GitHub accounts pushed secret-stealing workflows into repositories. Aikido cautions against attributing the November campaign to the same actor, noting that the infrastructure, tooling and tradecraft differ — a sign that stolen developer credentials can fuel successive intrusions by different groups. Aikido's analysis does not explain how the attacker obtained the credentials, and offers no specific advice for the owners of the stolen accounts — which makes checking your own repositories the only safe move.

Should you care? What to do now

✅ Check every repository you can write to, from 10 November onward, for a wfx-docs branch, a "docs: dependency audit notes" pull request, or the commit titles above. A missing workflow run number is the more reliable sign the payload ran.

✅ If the stealer ran — or if your account opened one of the test pull requests at all — rotate every secret and cloud credential the repository's workflows could reach, and review cloud access logs for misuse.

✅ Do not install or open Packagist digitalelvis/neuronai-studio 3.14.3 or the affected Go module versions (v1.0.278 and v1.0.280). Treat any machine that did as compromised.

⏳ Watch for a GitHub response. The campaign's scale — tens of thousands of repositories probed — makes it one of the largest GitHub credential-abuse incidents reported this year, and further disclosures are likely as the investigation continues.

FAQs

What is the GitHub CI secret stealer attack of November 2026?
A campaign that began on 10 November 2026 in which an attacker used stolen credentials from 4,837 GitHub accounts to inject a secret-stealing workflow into repositories. The payload ran in at least 1,806 repositories, harvesting GitHub Actions secrets and cloud credentials, and the attacker deleted workflow runs and logs to cover the theft.

How do I know if my repository was affected?
Look for a pull request titled "docs: dependency audit notes" from a wfx-docs branch, commits titled "ci: refresh build cache", "chore: add ci helper" or "chore: add dependency audit workflow", or a gap in workflow run numbers from 10 November onward. A missing run number is the strongest sign the payload ran.

Is my account compromised if I only saw the test pull request?
According to Aikido Security, any account that opened one of the attacker's test pull requests is compromised, even if the stealer never ran. Rotate your credentials and review account activity if this applies to you.

Are the malicious packages dangerous to install?
Yes. Packagist package digitalelvis/neuronai-studio version 3.14.3 is malicious, and Go module github.com/onuragtas/docker-env versions v1.0.278 and v1.0.280 carry the stealer in a GitHub Actions workflow file. Any machine that installed or opened the Packagist version should be treated as compromised.

Takeaway: A still-active campaign has turned nearly 5,000 stolen GitHub accounts into a credential-harvesting machine across tens of thousands of repositories. If you write to any repository on GitHub, check for the wfx-docs probe now and rotate exposed secrets — the attacker is already deleting the evidence.

Sources

• Aikido Security — Compromised GitHub accounts push CI secret stealer to tens of thousands of repositories (primary research, 12 November 2026)
• The Hacker News — 4,837 Hijacked GitHub Accounts Ran a CI Secret Stealer in 1,806+ Repositories, Then Wiped the Logs
• GBHackers — Hackers Compromise Nearly 5,000 GitHub Accounts to Steal Secrets From Software Development Pipelines (12 November 2026)