Live threats
HighUnpatched Check Point Gateways Exploited via PHP2Shell, Granting Root Access and Enabling Wiper Attacks BreachUS DOJ Seizes $1.2 B Stolen from Binance Theft and Disrupts North Korean ‘FaceStealer’ Social‑Engineering Tool Rule changeFederal Register limits automated scraping of its sites, directing users to APIs DeadlineFarm Credit Administration amends employee payroll system of records under Privacy Act, effective Nov 24, 2026 CriticalCritical Red Hat Quay Flaw Lets Attackers Read and Overwrite All Private Container Images BreachHackers Compromise 4,800 GitHub Accounts to Steal Cloud Credentials and CI Secrets Rule changeEFF warns ambient surveillance devices expand privacy risks for bystanders CriticalNew Windows “SignDrop” Zero‑Day Lets Attackers Escalate to SYSTEM Privileges
Updated 08:43 UTC All intelligence →
Digital Trust PractitionersAssociation of Digital Trust Practitioners · TrustPractitioners.org
EN
JoinJoin
BREACH WATCH BRIEF High ☁️ Breach

Hackers Compromise 4,800 GitHub Accounts to Steal Cloud Credentials and CI Secrets

A coordinated wfx‑loot campaign used thousands of stolen GitHub credentials to open malicious pull requests, inject a credential‑stealing script into CI/CD workflows, and exfiltrate cloud and developer secrets from at least 1,835 repositories. The breach highlights gaps in access‑control and secret‑management practices that affect audit readiness across multiple frameworks.

ADTP Breach Watch · November 12, 2026 · BleepingComputer
SeverityHigh
Type☁️ Breach
ConfidenceHigh
ReportedNov 12, 2026
Technology & SaaS Software development organizations Cloud service providers Government agencies and public sector entities Stolen Credentials Data Exfiltration

What happened

Attackers leveraged ~4,800 compromised GitHub accounts to open pull requests on 61,764 repositories, inject a 1,500‑line script that harvested cloud and developer credentials, exfiltrated the data, and quickly removed traces.

Why it matters for trust and compliance

  • The incident shows how weak CI/CD access controls can undermine identity‑and‑access‑management controls required by frameworks such as NIST CSF 2.0.
  • Demonstrates the need for continuous monitoring of privileged CI/CD accounts and evidence collection for audit trails.
  • Supports mapping of credential‑management controls to multiple frameworks, strengthening third‑party risk assessments.

Who is affected

Software development organizations Cloud service providers Government agencies and public sector entities

Recommended actions

  1. Rotate all exposed GitHub and cloud credentials immediately.
  2. Enforce least‑privilege access and branch‑protection policies on GitHub.
  3. Deploy automated secret‑scanning and retain immutable CI/CD logs.
  4. Conduct a third‑party risk review of external contributors with publishing rights.
  5. Implement continuous monitoring of CI/CD pipelines for anomalous activity.

Regulations library

Every US state privacy law, on one map

24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.

Explore the mapFollow Regulatory Watch
  • In force
  • Coming into force
  • Sector laws
AK ME VT NH WA ID MT ND MN IL WI MI NY RI MA OR NV WY SD IA IN OH PA NJ CT CA UT CO NE MO KY WV VA MD DE AZ NM KS AR TN NC SC DC OK LA MS AL GA HI TX FL

Get the Breach Digest

The incidents that matter for your vendors and your data, analyzed for practitioners, in one email.