2026-11-14
About 4,800 GitHub Accounts Abused With Apparently Stolen Tokens, CI Secrets and Cloud Credentials Stolen (November 2026): What Repository Owners Should Do Today
Starting around November 10, 2026, about 4,800 GitHub accounts were used with valid tokens that appear to have been stolen to send probe pull requests to a very large number of repositories, and in some of them to make malicious changes that stole GitHub Actions secrets and cloud credentials. The three security firms that investigated count different things. Firm A reports that 4,837 accounts sent probe pull requests to 61,764 repositories and that the malicious code ran and sent credentials out in at least 1,835 repositories. Firm B counts 8,093 public repositories that received malicious changes (not the number where it ran). Firm C says no GitHub Actions flaw was exploited and valid tokens were used. Some probe pull requests came from tokens issued to one cloud provider's GitHub app; that provider says its own infrastructure was not breached and that its deploy process left tokens where some customer apps exposed them. GitHub has published nothing on this as of the November 14 check (not stated). Our view: this is a kind of attack that waiting for a patch cannot stop. The priorities are checking for unfamiliar pull requests, branches and Actions runs, revoking and reissuing secrets, and reviewing cloud trust settings.