---
title: Hijacked GitHub Accounts Plant a CI Secret Stealer, Then Wipe Logs
description: A GitHub token-theft campaign that was still running on November 12 has drained Actions secrets and cloud keys from more than 1,800 repositories.
canonical_url: https://codekeeper.co/ticker/hijacked-github-accounts-plant-a-ci-secret-stealer-then-wipe-logs
---

[Cyberattacks](https://codekeeper.co/ticker/tag/cyberattacks) | [Software security](https://codekeeper.co/ticker/tag/software-security)

# Hijacked GitHub Accounts Plant a CI Secret Stealer, Then Wipe Logs

A GitHub token-theft campaign that was still running on November 12 has drained Actions secrets and cloud keys from more than 1,800 repositories.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Nov 13, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhijacked-github-accounts-plant-a-ci-secret-stealer-then-wipe-logs%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhijacked-github-accounts-plant-a-ci-secret-stealer-then-wipe-logs%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhijacked-github-accounts-plant-a-ci-secret-stealer-then-wipe-logs%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhijacked-github-accounts-plant-a-ci-secret-stealer-then-wipe-logs%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhijacked-github-accounts-plant-a-ci-secret-stealer-then-wipe-logs%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhijacked-github-accounts-plant-a-ci-secret-stealer-then-wipe-logs%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

Since November 10, 2026, an attacker with stolen tokens for 4,837 GitHub accounts has probed more than 60,000 repositories for write access, then pushed a credential stealer wherever it could. Aikido Security, which named the campaign wfx-loot, says the payload exfiltrated secrets from more than 1,800 repositories. No GitHub bug was used, just valid developer and bot tokens. The cleanup sets it apart. Within about a minute, the attacker reverted each commit and deleted the workflow run and its logs. The script takes Actions secrets, runner memory, and cloud and AI service keys, and tries to stay in AWS and Azure accounts after rotation. Automated publishing also carried it into a Packagist package and Go modules. From about 05:30 UTC on November 12, new copies sent stolen data only to Telegram, so blocking known IP addresses stopped working. Anyone who finds a “docs: dependency audit notes” pull request should treat every reachable secret as stolen, rotate it, revoke the account’s tokens, and remove any cloud persistence the stealer added. Source: [SecurityWeek](https://www.securityweek.com/attacker-targets-60000-github-repositories-in-credential-theft-campaign/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhijacked-github-accounts-plant-a-ci-secret-stealer-then-wipe-logs%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhijacked-github-accounts-plant-a-ci-secret-stealer-then-wipe-logs%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhijacked-github-accounts-plant-a-ci-secret-stealer-then-wipe-logs%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhijacked-github-accounts-plant-a-ci-secret-stealer-then-wipe-logs%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhijacked-github-accounts-plant-a-ci-secret-stealer-then-wipe-logs%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhijacked-github-accounts-plant-a-ci-secret-stealer-then-wipe-logs%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Cyberattacks One Toolmaker May Be Arming Three China-Nexus Espionage Campaigns Nov 13, 2026](https://codekeeper.co/ticker/one-toolmaker-may-be-arming-three-china-nexus-espionage-campaigns)

[Cyberattacks Hacker Defaces Victoria’s Exam Board Site Mid-Exams, Claims Leaks Nov 13, 2026](https://codekeeper.co/ticker/hacker-defaces-victorias-exam-board-site-mid-exams-claims-leaks)

[Cyberattacks Settra-Linked GhostFrame Kit Pulls Windows Passwords From ESXi Nov 11, 2026](https://codekeeper.co/ticker/settra-linked-ghostframe-kit-pulls-windows-passwords-from-esxi)

[Cyberattacks Forgotten Qubole Integrations Gave a Hacker Keys to Company Clouds Nov 11, 2026](https://codekeeper.co/ticker/forgotten-qubole-integrations-gave-a-hacker-keys-to-company-clouds)