# Researchers find GitHub campaign stole secrets from at least 1,835 targets

_Published Thursday, November 12, 2026 at 6:31 PM EST · Security · Latest · Tier 2 — Notable_

![Researchers find GitHub campaign stole secrets from at least 1,835 targets — Primary](https://www.bleepstatic.com/content/hl-images/2026/10/08/github.jpg)

Aikido researchers confirmed that a campaign using 4,837 compromised GitHub accounts stole secrets from at least 1,835 targets, BleepingComputer reported. The campaign began November 10 and probed 61,764 repositories for write access through pull requests disguised as dependency audit notes.

Attackers inserted a credential-stealing script through GitHub Actions workflows or an npm install hook. The script collected cloud and developer credentials and could exchange workflow identity tokens for cloud sessions. Automated publishing also carried the payload into Packagist and Go module releases. Not every targeted repository executed the payload; Aikido believes secret theft was the primary objective.

## Sources

- [BleepingComputer](https://www.bleepingcomputer.com/news/security/hackers-compromise-4-800-github-accounts-to-steal-cloud-credentials/)

---
Canonical: https://techandbusiness.org/newswire/rvmSdvdwcIfcHoHlPKbSRP
Published: 2026-11-12T23:31:46.273Z
Story chronology: 2026-11-12T22:25:30.000Z
Retrieved: 2026-11-13T03:04:07.619Z
Publisher: Tech & Business (techandbusiness.org)