Stolen GitHub access exposes code pipelines and cloud secrets
This is a DailyCyber.News update, brought to you by BareMetalCyber.com, for Friday, November 13th, 2026.
Development pipelines and cloud environments were put at risk after an attacker used stolen GitHub access to probe more than sixty thousand repositories. Roughly four thousand eight hundred compromised accounts submitted pull requests to test whether they could make changes. Researchers confirmed that secrets were stolen from at least one thousand eight hundred thirty five targets.
This wasn’t an exploit against GitHub Actions. The attacker relied on valid tokens, inserted malicious code into workflows or installation hooks, and then tried to conceal the activity by reverting changes and deleting workflow records.
The malware searched for repository secrets, cloud credentials, GitHub tokens and AI service keys. Where permissions allowed, it could obtain cloud-session access in AWS, Azure and GCP, and attempt to establish persistence in AWS and Azure.
For leaders, developer and automation identities should be treated as privileged enterprise access. For defenders, review suspicious pull requests, workflow changes, installation hooks and unexplained gaps in run histories. Trusted development access can become a bridge from source code to cloud control.
Revoke affected tokens, rotate every accessible secret and investigate unauthorized cloud changes.
For the sources and the full Daily Cyber newsletter, visit DailyCyber.News.
