# Hijacked GitHub accounts deploy credential stealer across repositories

_Published Thursday, November 12, 2026 at 3:46 AM EST · Security · Latest · Tier 1 — Major_

![Hijacked GitHub accounts deploy credential stealer across repositories — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh1-4OiOkGLcK3fAr2HdhALOfc_BqR21440TsjUIuCNzv4YL0lWRC3lvUjE1vu2RdVfjunxi80gMQyGpjvUdWzMRtthW8_-hFOJ79YhFzJrNGgoKDPYXm2OaWOsN8kgBELqOPs5s9QKL4qzQzu_3NEEqHygpfQzKYxDRIQeFgMHj24oyPyaslUemke-loU/s1700-nu-rw-lo-l85-e365/github.jpg)

An attacker used stolen credentials for 4,837 GitHub accounts to deploy a credential stealer that ran in at least 1,806 repositories, according to Aikido Security. The Hacker News found further test pull requests early Thursday, though whether those were followed by the stealer was unclear.

The malware targets secrets and cloud credentials accessible to automated software workflows. It can exchange GitHub identity tokens for cloud sessions and alter AWS or Azure access settings to preserve access after credential rotation.

SafeDep separately counted 8,093 repositories receiving malicious commits, a broader measure than successful execution. Researchers advise affected owners to revoke account access and rotate exposed secrets; cloud access changes can require additional remediation.

## Sources

- [The Hacker News](https://thehackernews.com/2026/11/4837-hijacked-github-accounts-ran-ci.html)

---
Canonical: https://techandbusiness.org/newswire/G7fE0K3GtEarTcDr5F1GAe
Published: 2026-11-12T08:46:26.055Z
Story chronology: 2026-11-12T06:42:00.000Z
Retrieved: 2026-11-12T10:42:19.173Z
Publisher: Tech & Business (techandbusiness.org)