Skip to navigation

Threat reportSupply ChainTL-2026-5815

Compromised GitHub Accounts Push CI Secret Stealer to Tens of Thousands of Repositories (November 2026 Wave)

criticalACTIVE

Beginning 2026-11-10 ~12:45 UTC, 4,837 compromised GitHub accounts opened probe pull requests titled 'docs: dependency audit notes' in 61,764 repositories and pushed payloads that steal GitHub Actions secrets and cloud credentials to attacker servers on port 8080 (/exfil). At least 1,806 repositories executed the payload, and at least 50 compromised users publish packages on npm, Go, Packagist, PyPI, or crates.

Key facts

IdentifiersTL-2026-5815
Also known asNovember 2026 GitHub Actions secret stealer wave
SeverityCRITICAL
First disclosed
Affected productsGitHub GitHub Actions workflows in repositories owned or accessible by compromised accounts; digitalelvis neuronai-studio (Packagist); onuragtas github.com/onuragtas/docker-env (Go module, repo onuragtas/redock)
MalwareGhostAction
Toolsactions/github-script@v7
MITRE ATT&CK techniquesT1003.007 OS Credential Dumping: Proc Filesystem, T1005 Data from Local System, T1036 Masquerading, T1036.005 Match Legitimate Resource Name or Location, T1041 Exfiltration Over C2 Channel, T1053.003 Cron, T1059.004 Unix Shell, T1059.007 JavaScript, T1070 Indicator Removal, T1071.001 Web Protocols, T1078 Valid Accounts, T1078.004 Valid Accounts and 18 more in the attack flow
MotivationUNKNOWN
Target sectorstechnology, software-development, open-source
Target regionsGlobal
Detection rules9 (1 shown free)
Sources8 cited sources

Detection coverage

As of 2026-11-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5815 across Splunk SPL, Microsoft KQL and Sigma, covering 48 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: GitHub Probe PR / Payload Commit Markers from Compromised Account — Exploitation

Detects the November 2026 GitHub Actions secret-stealer wave (TL-2026-5815) at the repository-event layer: the probe pull request titled 'docs: dependency audit notes' from branch wfx-docs, the three payload commit messages ('ci: refresh build cache', 'chore: add ci helper', 'chore: add dependency audit workflow') and a build-audit workflow file on a throwaway chore/<8 char> branch. Aggregated per actor so one compromised token touching many repositories stands out. Requires GitHub audit/webhook (push, pull_request) events indexed in Splunk.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1195, T1195.002, T1078, T1199
  • Data sources: github:cloud:audit, github:enterprise:audit, GitHubAuditLogPolling_CL, github audit log
  • Severity: high
  • Confidence: high

Splunk SPL

index=github sourcetype IN ("github:cloud:audit","github:enterprise:audit") ```TL-2026-5815 probe PR and payload commit markers``` | eval raw=lower(_raw) | eval probe_pr=if(match(raw,"docs: dependency audit notes") OR match(raw,"wfx-docs"),1,0), payload_commit=if(match(raw,"ci: refresh build cache|chore: add ci helper|chore: add dependency audit workflow"),1,0), throwaway_wf=if(match(raw,"chore/[a-z0-9]{8}") AND match(raw,"build-audit-[a-z0-9]+[.]yml"),1,0) | where probe_pr=1 OR payload_commit=1 OR throwaway_wf=1 | eval actor=coalesce(actor,user,"unknown"), repo=coalesce(repo,repository,"unknown") | stats count earliest(_time) as first_seen latest(_time) as last_seen dc(repo) as repos_touched values(action) as actions max(probe_pr) as probe_pr max(payload_commit) as payload_commit max(throwaway_wf) as throwaway_wf by actor | eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T") | sort - repos_touched | table actor repos_touched count actions probe_pr payload_commit throwaway_wf first_seen last_seen

Microsoft KQL

GitHubAuditLogPolling_CL | where TimeGenerated > ago(24h) | extend raw = tolower(tostring(pack_all())) | extend probe_pr = raw contains 'docs: dependency audit notes' or raw contains 'wfx-docs', payload_commit = raw contains 'ci: refresh build cache' or raw contains 'chore: add ci helper' or raw contains 'chore: add dependency audit workflow', throwaway_wf = (raw matches regex 'chore/[a-z0-9]{8}' and raw matches regex 'build-audit-[a-z0-9]+[.]yml') | where probe_pr or payload_commit or throwaway_wf | extend Actor = tostring(coalesce(column_ifexists('actor_s',''), column_ifexists('actor_login_s',''))), Repo = tostring(column_ifexists('repo_s','')), Action = tostring(column_ifexists('action_s','')) | summarize Events=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Repos=dcount(Repo), Actions=make_set(Action, 20) by Actor, probe_pr, payload_commit, throwaway_wf | order by Repos desc

Sigma

title: TL-2026-5815 GitHub Probe PR or Payload Commit Markers from Compromised Account
id: 6b0f2a1e-3c4d-4e57-9a18-5d2c7e9b4f10
status: experimental
description: |
    Detects the November 2026 GitHub Actions secret-stealer wave. Keywords match the probe pull request title
    'docs: dependency audit notes', the wfx-docs probe branch and the three payload commit messages pushed after a
    successful write-access probe.
references:
    - https://www.aikido.dev/blog/compromised-github-accounts-push-ci-secret-stealer-to-tens-of-thousands-of-repositories
author: Threadlinqs Team
date: 2026-11-12
tags:
    - attack.initial-access
    - attack.t1078
    - attack.t1199
    - attack.t1195.002
logsource:
    product: github
    service: audit
detection:
    keywords:
        - 'docs: dependency audit notes'
        - 'wfx-docs'
        - 'ci: refresh build cache'
        - 'chore: add ci helper'
        - 'chore: add dependency audit workflow'
    condition: keywords
falsepositives:
    - Legitimate documentation pull requests that reuse the same title or branch name
    - Internal tooling that uses the same commit message conventions
level: high

Known false positives:

  • Legitimate documentation pull requests that happen to reuse the title 'docs: dependency audit notes' or a branch named wfx-docs
  • Internal security tooling that adds audit workflows on chore/ branches or uses the same commit message conventions

Tuning notes: Confirm PR/push webhook events (not only the audit log) are ingested, since PR titles and commit messages are not in every audit stream. Field names (actor, repo, action) vary by connector, so adjust the coalesce() lists. Allow-list known automation accounts. Treat any hit on the exact PR title plus the wfx-docs branch as a confirmed token compromise and rotate that account's tokens.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Campaign Workflow File or Helper Script Written to Endpoint — Exploitation · unlock with TL Creds
  • GhostAction-Linked #ghc2 Cron Persistence Polling [indicator]:8080 — Post-Exploitation · unlock with TL Creds
  • HTTP Exfiltration to /exfil on Port 8080 and Legacy GhostAction Infrastructure — C2 / Exfiltration · unlock with TL Creds
  • Install of Compromised neuronai-studio 3.14.3 or docker-env v1.0.278/v1.0.280 — Exploitation · unlock with TL Creds
  • Credential, Cloud Metadata and Git History Harvesting by node/shell — Post-Exploitation · unlock with TL Creds
  • CI Runner Process Using Campaign Callback, WF_* Variables or Hardcoded Token — C2 / Exfiltration · unlock with TL Creds
  • CI Helper Script via postinstall and Disguised woff2 JavaScript Execution — Post-Exploitation · unlock with TL Creds
  • Egress to Campaign Exfiltration Servers on TCP 8080 — C2 / Exfiltration · unlock with TL Creds

Indicators of compromise

As of 2026-11-12, Threadlinqs Intelligence tracks 48 indicators of compromise for TL-2026-5815.

Sample indicators (3 of 48)

  • IP address: 194.150.166[.]244
  • Domain: carte-avantage[.]com
  • File hash: 89695abb392d5cfd4972672961e644bb46baa98aa1ed7173c2a2816c762735cf

Defanged, TLP:CLEAR. Full set of 48 indicators: unlock with TL Creds.

48 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

Aikido Security reports a large-scale supply-chain campaign in which stolen GitHub tokens were used to act as legitimate accounts. Starting 2026-11-10 at about 12:45 UTC, 4,837 compromised accounts opened probe pull requests titled 'docs: dependency audit notes' from a branch named 'wfx-docs' in 61,764 repositories. The probe confirms write access; if it succeeds the account is treated as compromised even if the payload never runs. 10,431 of the probe PRs targeted repositories the account does not own, reached through collaborator or organization access, and about 92% of those remain open.

After a successful probe the actor pushes one of three payload variants. (1) Workflow injection, commit message 'ci: refresh build cache', adds roughly 1,500 lines to an existing workflow. (2) Install hook, commit message 'chore: add ci helper', adds a '.ci-xxxxxx.sh' script and a 'postinstall' hook in package.json that runs on any 'npm install'. (3) Throwaway branch, commit message 'chore: add dependency audit workflow', adds '.github/workflows/build-audit-xxxxxx.yml' on a 'chore/xxxxxxxx' branch. Injected steps include 'Pass runtime' (using actions/github-script@v7) and 'Restore cache j632'. The latter sets WF_CALLBACK (exfiltration URL), WF_CTOKEN (a hardcoded campaign token), WF_SECRETS (toJSON(secrets)) and WF_VARS (toJSON(vars)).

Targeted data includes GitHub Actions secrets and variables, the workflow GITHUB_TOKEN, Actions runtime and cache tokens, AWS/GCP/Azure credentials from instance metadata and OIDC, secrets in runner memory and environment variables (including AI provider API keys), repository contents and git history, the Actions cache, and build artifacts. Exfiltration goes to /exfil endpoints on port 8080 at 194.150.166.244 and 18.143.168.96; the source does not state the encoding. The actor reverts the change within about a minute and deletes the workflow run and its logs, so a gap in workflow run numbers may be the only trace. At least 1,806 repositories ran the payload and had credentials published; the true number is likely higher because run logs were deleted.

Overlap with the October 'GhostAction' wave is significant: accounts hit in October were about 1,000 times more likely than other active accounts to be used in November, and in more than 100 repositories the November payload was injected into October workflow files with the October exfiltration step left in place. October indicators include secret-scanning workflows (security-audit.yml, audit.yml, ci-check.yml) sending keys to 193.32.204.199, and a hidden VS Code task running JavaScript disguised as public/fonts/fa-solid-400.woff2 that steals ~/.git-credentials, SSH keys, and npm, PyPI, AWS and Claude credentials and installs a cron job tagged #ghc2 polling 193.32.204.199:8080. The source does NOT attribute the November wave to the same actor. Affected artifacts named by the source: Packagist digitalelvis/neuronai-studio 3.14.3 (treat any machine that installed or opened it as compromised) and Go module github.com/onuragtas/docker-env v1.0.278/v1.0.280 (payload only in a workflow file; Go source and binaries unchanged). Caveat: this is single-source vendor reporting; IOCs should be validated against additional sources. BeaconBeagle lookups for the three IPs returned HTTP 502 and could not be completed.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003.007 OS Credential Dumping: Proc Filesystem; T1528 Steal Application Access Token; T1552.001 Credentials In Files; T1552.003 Unsecured Credentials; T1552.004 Unsecured Credentials; T1552.005 Cloud Instance Metadata API

Collection

T1005 Data from Local System; T1119 Automated Collection; T1213.003 Code Repositories; T1560.001 Archive Collected Data

Defense Evasion

T1036 Masquerading; T1036.005 Match Legitimate Resource Name or Location; T1070 Indicator Removal; T1550.001 Use Alternate Authentication Material; T1562 Impair Defenses

Exfiltration

T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service

Persistence

T1053.003 Cron; T1098.001 Additional Cloud Credentials

Execution

T1059.004 Unix Shell; T1059.007 JavaScript

Command and Control

T1071.001 Web Protocols

Initial Access

T1078 Valid Accounts; T1078.004 Valid Accounts; T1195 Supply Chain Compromise; T1195.001 Compromise Software Dependencies and Development Tools; T1195.002 Compromise Software Supply Chain; T1199 Trusted Relationship

Discovery

T1526 Cloud Service Discovery

Resource Development

T1586 Compromise Accounts

Remediation

Immediate actions

  • Assume all secrets, variables, GITHUB_TOKEN-accessible resources and cloud roles available to any workflow that ran the payload are compromised and rotate them
  • Rotate GitHub Actions secrets and variables, AWS/GCP/Azure credentials, OIDC-trusted roles and AI provider API keys reachable from affected workflows
  • Search repositories and PRs for the title 'docs: dependency audit notes', branches wfx-docs, chore/[a-z0-9]{8} and ci-check-[0-9]{4}, and the listed commit messages
  • Review workflow run histories for gaps in run numbers that indicate deleted runs
  • Block 194.150.166.244, 18.143.168.96 and 193.32.204.199 (port 8080) at the network layer
  • Revoke or reset tokens for compromised users and audit collaborator and organization access

Workarounds

  • Remove digitalelvis/neuronai-studio 3.14.3 and check any machine that installed or opened it
  • Remove github.com/onuragtas/docker-env v1.0.278 and v1.0.280
  • Check for the October-linked #ghc2 cron job and public/fonts/fa-solid-400.woff2

Longer-term hardening

  • Restrict GitHub token scopes and prefer short-lived, fine-grained credentials
  • Require review for changes to .github/workflows and monitor for workflow files added on throwaway branches
  • Limit egress from CI runners to approved destinations

Affected and fixed versions

  • GitHub — GitHub Actions workflows in repositories owned or accessible by compromised accounts
    Vulnerable versions: Repositories where a probe PR or payload commit was pushed from 2026-11-10
  • digitalelvis — neuronai-studio (Packagist)
    Vulnerable versions: 3.14.3
  • onuragtas — github.com/onuragtas/docker-env (Go module, repo onuragtas/redock)
    Vulnerable versions: v1.0.278; v1.0.280

Timeline

Last updated · 3 updates · revalidated 3× · latest source

  • Original GhostAction campaign: a compromised FastUUID maintainer account pushes 'Add Github Actions Security workflow'; GitGuardian later counts 817 repositories, 327 users and 3,325 secrets exfiltrated (C2 locked-ioc-17).
  • GitGuardian observes a second GhostAction wave of about 500 new commits, mostly in previously compromised repositories, using locked-ioc-13 on the same IP.
  • StepSecurity reports the attacker re-triggering the current payload in typecho-fans/plugins under the compromised xxyangyoulin account; runs stalled at an approval gate (payload first seen 2026-09-05).
  • October GhostAction wave: compromised kitao and henrywoo accounts push locked-ioc-12 to 27 and 318 repositories; the payload mines full git history and exfiltrates over plain HTTP to locked-ioc-16 (StepSecurity).
  • StepSecurity publishes 'GhostAction Returns': 378 repositories carry a live malicious workflow on the default branch.
  • Branch ci-check-2830 is created on the digitalelvis account, listed by SafeDep as a repository indicator in the neuronai-studio case.
  • Following successful probes, the actor pushes workflow-injection, install-hook or throwaway-branch payloads, reverts them within about a minute and deletes the workflow runs and logs.
  • At about 12:45 UTC the November campaign begins using stolen GitHub tokens; compromised accounts start opening probe PRs titled 'docs: dependency audit notes' from the wfx-docs branch.
  • First victim disclosure at 06:33 UTC: a leaked GitHub CLI OAuth token reported in a StringKe/kxen issue (Endor Labs).
  • At 09:17:23 UTC the stealer is committed to drunomics/nuxtjs-drupal-ce; the bot drubot reverts it 12 seconds later ('ci: restore') and workflow run #1964 is deleted (StepSecurity).
  • Malicious commits reach digitalelvis/neuronai-studio (tag v3.14.3, commit 45da53a, later reverted) and vkuznet/gocurl (commit 8d5aad0, pseudo-version v0.0.0-20261111095532-8d5aad0cb0da).
  • At 15:00 UTC the probe-PR window used in Aikido's GitHub search ends, with 61,839 PRs titled 'docs: dependency audit notes' found; 4,837 accounts and 61,764 repositories are tallied across the campaign.
  • StepSecurity sees more than 62,000 probe PRs (about 90% still open) and more than 21,000 'ci: refresh build cache' commits in GitHub search.
  • Two 'chore: add ci helper' commits are pushed to webdriverio/webdriverio as wdio-bot, which could bypass branch protection; reverted within 20 minutes (PR #16444).
  • Cleanup fails in nextcloud/docker (run #2675, commit b4353fc), exposing the stealer's status log; a developer reverts it about 27 minutes later.
  • From about 05:30 UTC new stealer copies exfiltrate to a Telegram chat and no longer include a collection IP (StepSecurity).
  • SafeDep's search window ends at 04:36 UTC with the campaign still active: 8,093 repositories with malicious commits; three further wfx-docs test PRs seen in the 05:04-05:38 window. The Hacker News corrects its report to add the third exfiltration server (locked-ioc-20) and the Telegram channel.
  • Aikido Security publishes its analysis: at least 1,806 repositories ran the payload and had credentials published, and at least 50 compromised users publish packages on npm, Go, Packagist, PyPI or crates.

Update history

Sources cited

Further reading

Drafted by the Threadlinqs research pipeline from 8 sources; published ; last updated .

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats