Attacker Uses Hijacked GitHub Accounts to Deploy CI Secret Stealer Across Repositories

An attacker leveraged nearly five thousand compromised GitHub accounts to plant malicious code designed to harvest secrets from CI/CD workflows across thousands of repositories. The campaign successfully targeted sensitive cloud credentials and API tokens, highlighting significant risks to software supply chain security and automated build environments.