> ## Content Index
> Fetch the complete content index at: https://cyfrz.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Attacker Uses 4,837 Hijacked GitHub Accounts to Run a Secret Stealer
- URL: https://cyfrz.com/attacker-uses-4-837-hijacked-github-accounts-to-run-a-secret-stealer/
- Published: 2026-11-12T21:35:20.000Z
- Updated: 2026-11-12T21:35:20.000Z
- Author: 9ino
- Tags: News, Cybercrime

Starting Tuesday, an attacker used stolen credentials for 4,837 GitHub accounts to plant a CI secret stealer in repositories those accounts could write to, according to Aikido Security. The stealer ran in at least 1,806 repositories, putting build secrets and cloud keys at risk. Teams should rotate any tokens exposed to affected pipelines, review recent workflow changes, and turn on multi factor authentication for every account with write access.

For more, visit [The Hacker News](https://thehackernews.com/2026/11/4837-hijacked-github-accounts-ran-ci.html?ref=cyfrz.com).