Attacker hijacks 4,837 GitHub accounts to steal CI secrets

An attacker compromised 4,837 GitHub accounts and injected a secret stealer into at least 1,806 repositories. The malicious code targeted CI workflow credentials and cloud secrets accessible to those pipelines. GitHub and the security community are investigating the scope of compromised repositories and affected organizations. Users should rotate compromised credentials and review repository access logs immediately.