Hackers Compromise 4,800 GitHub Accounts to Steal Cloud Credentials and CI Secrets

Qué ocurrió

Attackers leveraged ~4,800 compromised GitHub accounts to open pull requests on 61,764 repositories, inject a 1,500‑line script that harvested cloud and developer credentials, exfiltrated the data, and quickly removed traces.

Por qué es importante para la confianza y el cumplimiento

• The incident shows how weak CI/CD access controls can undermine identity‑and‑access‑management controls required by frameworks such as NIST CSF 2.0.
• Demonstrates the need for continuous monitoring of privileged CI/CD accounts and evidence collection for audit trails.
• Supports mapping of credential‑management controls to multiple frameworks, strengthening third‑party risk assessments.

Who is affected

Recommended actions

1. Rotate all exposed GitHub and cloud credentials immediately.
2. Enforce least‑privilege access and branch‑protection policies on GitHub.
3. Deploy automated secret‑scanning and retain immutable CI/CD logs.
4. Conduct a third‑party risk review of external contributors with publishing rights.
5. Implement continuous monitoring of CI/CD pipelines for anomalous activity.