TI Mindmap HUB
Threat Intelligence Report

Compromised GitHub accounts push CI secret stealer to tens of thousands of repositories

📅 November 12, 2026 📰 www.aikido.dev 🔍 0 CVE(s) referenced

Stolen GitHub credentials enabled a “wfx” CI stealer to probe over 61,000 repositories and exfiltrate GitHub Actions secrets and cloud credentials from at least 1,806, with limited spillover into published packages.

unclassified

Sign in to access the full report including:
detailed analysis, IOCs, MITRE ATT&CK mapping, and STIX bundle.

🔐 Sign In to Read Full Report

You'll need to accept our Terms of Service to access the platform.

📊 Visual Mindmap
🎯 IOC Extraction
⚔️ MITRE ATT&CK TTPs
📦 STIX 2.1 Bundle