Hackers hijacked 1,900 GitHub accounts. Then they went after 30,000 repos.

Hackers compromised about 1,900 GitHub accounts to inject malicious workflows into over 30,000 repositories, aiming to steal CI/CD secrets, cloud keys, and AI API tokens. The attack exploited stolen credentials to modify workflows directly, scanning Git history for sensitive data and sending it to an attacker-controlled server. GitHub has since blocked the malicious workflows, but the full extent of stolen credentials remains unknown.