GitHub accounts compromised in large-scale malicious code injection

Security experts at Socket have uncovered a large-scale cyberattack targeting the developer platform GitHub. Since October 7, 2026, over 500 compromised accounts have been used to inject malicious code into tens of thousands of software repositories via manipulated GitHub Actions workflows.

The attackers aim to steal sensitive credentials, including cloud infrastructure access keys, AI service keys, and GitHub login data, directly from development environments and automated deployment processes. The stolen data is automatically transmitted to a hardcoded IP address. Notable accounts, including those of Takashi Kitao and Henry Wu, were involved in spreading the malicious code across hundreds of repositories.