4,837 Hijacked GitHub Accounts Ran a CI Secret Stealer in 1,806+ Repositories, Then Wiped the Logs

Starting Tuesday, an attacker used stolen credentials for 4,837 GitHub accounts to plant a secret stealer in repositories those accounts could write to, according to Aikido Security, a security software company. The stealer is built to take the secrets and cloud credentials that a repository's CI...