Major attack on GitHub: 4.837 accounts compromised for digital key theft

dev.to GitHub2026-11-12 15:390 views

Since Tuesday, a widespread campaign has compromised 4,837 GitHub accounts by injecting malicious code into at least 1,806 repositories.

The attack utilizes pull requests to deploy malware that harvests cloud provider credentials and CI secrets.

The software can also establish persistent access via federated credentials in Azure AD.

This report details the attack vector, the credentials at risk, and the necessary mitigation steps, including token rotation and the mandatory audit of recent pull requests.

How the attack is carried out

The perpetrators use the compromised accounts to submit code change proposals (pull requests) to third-party projects, using the title 'docs: dependency audit notes' and a specific branch called 'wfx-docs'.

If the suggestion is accepted, a malicious program is installed. This program has been detected in at least 1.806 software repositories and can:

Steal digital access keys for cloud services (such as AWS, Azure, Google Cloud, and Kubernetes).
Intercept secret keys used in automated processes.
Steal files from a local computer if the user executes a command like 'npm install'.
Add digital credentials to Azure AD to maintain permanent access.

Attackers often erase their traces and code execution within minutes of the attack, trying to remain unnoticed.

Who is affected and what are the risks?

The attack puts anyone managing software projects on GitHub at risk. If the digital keys fall into the wrong hands, attackers could gain access to corporate infrastructure, steal data, or maintain permanent access to the system. There has been no official claim of responsibility for the November incidents, while some package releases on platforms like Packagist have already been flagged as dangerous.

What you have to do

If you manage projects on GitHub, researchers recommend the following protection measures:

Revoke all digital access keys and SSH keys used in your projects.
Immediately change all secret keys that may have been exposed.
Enable two-factor authentication (2FA) on all your accounts.
Carefully check your project history to look for the suspicious changes mentioned above.