- Published
- Source
- CSO Online UK
- Reported by
- 2 publishers
- Filed under
- UK industry, Malware & exploits
Researchers have uncovered a campaign in which hijacked GitHub accounts spread secret-stealing malware across thousands of repositories. The payload executed in at least 1,806 repos, exfiltrating CI/CD secrets and cloud credentials. Aikido Security, which detected and documented the campaign, said the attackers used the 4,837 compromised accounts to open probe pull requests in 61,764 repositories starting Nov. 10. Around 92% of those pull requests, titled “docs: dependency audit notes,” are still open, which suggests most project owners have not seen…
Keeping malware out
- Keep operating systems, browsers and plugins patched – most malware arrives through known holes.
- Block macros and scripts from the internet, and let only approved software run where you can.
- Watch endpoint alerts for new persistence: scheduled tasks, services and run keys.
More helpNCSC: mitigating malware and ransomware attacks (opens in a new tab)
Also reported by 1 more publisher
Defender’s notebook
The attacker technique behind this story, in MITRE’s terms – and what to check in your own estate.
Valid Accounts
Stealth, Persistence, Privilege Escalation, Initial AccessWhat a defender checks
- Review risky sign-ins: impossible travel, new devices, unusual locations.
- Reset credentials and revoke sessions for affected accounts.
- Put phishing-resistant MFA on admin accounts first.
Build the skillBlue Team Analyst, Identity & Access Monitoring
Exfiltration Over Web Service
ExfiltrationWhat a defender checks
- Watch for large uploads to cloud storage and file-sharing sites.
- Hunt for tools like rclone and unexpected archive files.
- Use DLP on your most sensitive data.
Build the skillBlue Team Specialist, Breach Analysis
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
MyCyberWay training
Blue Team Analyst
Every story here started as an alert. Learn to triage them.
Our Blue Team Analyst programme prepares you for a first SOC role: 26 live classes in UK hours, an alert queue worked in Microsoft Sentinel, and a full SOC shift simulation at the end. No security experience needed to start.
- Triage and KQL in Microsoft Sentinel
- Identity, endpoint, email and network investigations
- A verifiable digital badge
Headlines and short summaries only, except where a public body publishes under an open licence. Every story links to its publisher, who owns it. MyCyberWay does not edit or endorse third-party reporting.