# Nearly 4,837 GitHub Accounts Hijacked in Major Supply-Chain Attack Attackers used stolen credentials to plant malicious code in repositories. - **Source:** [cybersecurity](https://brifing.si/source/57fea5eb-f11e-4b81-bc15-114313a8bd59) - **Published:** 2026-11-12 - **Topic:** [technology](https://brifing.si/c/technology) - **Original article:** - **On Brifing:** https://brifing.si/s/a63edf3b-2f4f-462f-88c6-8ea477594122 ## Scope of the Attack Aikido Security reported that attackers hijacked 4,837 GitHub accounts to plant malicious code in repositories. The code aimed to steal secrets and cloud credentials accessible through automated workflows. Researchers identified malicious execution in at least 1,806 repositories, while SafeDep counted 8,093 repositories affected. The attacks began on November 10, and the full extent is still under investigation. ## Method of Compromise Attackers used stolen credentials to gain access to GitHub accounts. Once inside, they planted malicious code designed to exploit automated build and testing workflows. This method allows attackers to steal credentials without requiring end users to download or execute malware directly. The compromised accounts turned even legitimate projects into potential threats. ## Impact on Repositories The malicious code was found in thousands of repositories, with Aikido Security reporting 1,806 affected and SafeDep identifying 8,093. These discrepancies arise from different measurement methods. The attack highlights the vulnerability of automated workflows, which attackers exploit to steal sensitive data without direct user interaction. ## Targeted Credentials The primary goal of the attack was to steal secrets and cloud credentials accessible through GitHub repositories. These credentials are often used in automated workflows for building and testing software. By compromising these workflows, attackers can access sensitive data without needing to deploy traditional malware. ## Timeline of the Attack The attacks began on November 10, with malicious code being pushed to repositories over a period of time. The full scope of the attack is still being investigated, as researchers continue to assess the extent of the compromise. The ongoing nature of the investigation suggests that more repositories could be affected. ## Risk to Legitimate Projects Even legitimate GitHub projects can become dangerous when a contributor account is compromised. Attackers can use these accounts to push malicious code into repositories, turning trusted projects into vectors for credential theft. This underscores the importance of securing contributor accounts and monitoring repository activity. ## Detection and Response Researchers from Aikido Security and SafeDep have been actively tracking the attack. Their efforts have identified thousands of compromised repositories, but the full extent remains unclear. GitHub users are advised to review their repositories for suspicious activity and update their security practices to prevent similar attacks. ## Broader Implications This attack highlights the growing threat of supply-chain attacks targeting software development platforms. By compromising GitHub accounts, attackers can exploit automated workflows to steal credentials on a large scale. This incident underscores the need for enhanced security measures in software development and continuous monitoring of repository activity. ## Sources covering this story - https://www.reddit.com/r/cybersecurity/comments/1xug7z5/nearly_4837_github_accounts_hijacked_in_major/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._