Hijacked GitHub accounts deploy credential stealer across repositories

An attacker used stolen credentials for 4,837 GitHub accounts to deploy a credential stealer that ran in at least 1,806 repositories, according to Aikido Security. The Hacker News found further test pull requests early Thursday, though whether those were followed by the stealer was unclear. The malware targets secrets and cloud credentials accessible to automated software workflows. It can exchange GitHub identity tokens for cloud sessions and alter AWS or Azure access settings to preserve access after credential rotation. SafeDep separately counted 8,093 repositories receiving malicious commits, a broader measure than successful execution. Researchers advise affected owners to revoke account access and rotate exposed secrets; cloud access changes can require additional remediation.