Nearly 4,837 GitHub Accounts Hijacked in Major Supply-Chain Attack
Attackers used stolen credentials to plant malicious code in repositories.
1Scope of the Attack
Aikido Security reported that attackers hijacked 4,837 GitHub accounts to plant malicious code in repositories. The code aimed to steal secrets and cloud credentials accessible through automated workflows. Researchers identified malicious execution in at least 1,806 repositories, while SafeDep counted 8,093 repositories affected. The attacks began on November 10, and the full extent is still under investigation.
2Method of Compromise
Attackers used stolen credentials to gain access to GitHub accounts. Once inside, they planted malicious code designed to exploit automated build and testing workflows. This method allows attackers to steal credentials without requiring end users to download or execute malware directly. The compromised accounts turned even legitimate projects into potential threats.
3Impact on Repositories
The malicious code was found in thousands of repositories, with Aikido Security reporting 1,806 affected and SafeDep identifying 8,093. These discrepancies arise from different measurement methods. The attack highlights the vulnerability of automated workflows, which attackers exploit to steal sensitive data without direct user interaction.
4Targeted Credentials
The primary goal of the attack was to steal secrets and cloud credentials accessible through GitHub repositories. These credentials are often used in automated workflows for building and testing software. By compromising these workflows, attackers can access sensitive data without needing to deploy traditional malware.
5Timeline of the Attack
The attacks began on November 10, with malicious code being pushed to repositories over a period of time. The full scope of the attack is still being investigated, as researchers continue to assess the extent of the compromise. The ongoing nature of the investigation suggests that more repositories could be affected.
6Risk to Legitimate Projects
Even legitimate GitHub projects can become dangerous when a contributor account is compromised. Attackers can use these accounts to push malicious code into repositories, turning trusted projects into vectors for credential theft. This underscores the importance of securing contributor accounts and monitoring repository activity.
7Detection and Response
Researchers from Aikido Security and SafeDep have been actively tracking the attack. Their efforts have identified thousands of compromised repositories, but the full extent remains unclear. GitHub users are advised to review their repositories for suspicious activity and update their security practices to prevent similar attacks.
8Broader Implications
This attack highlights the growing threat of supply-chain attacks targeting software development platforms. By compromising GitHub accounts, attackers can exploit automated workflows to steal credentials on a large scale. This incident underscores the need for enhanced security measures in software development and continuous monitoring of repository activity.
Original article: cybersecurity — Nearly 4,837 GitHub Accounts Hijacked in Major Supply-Chain Attack