Aikido Security said on November 12 that an attacker has used stolen GitHub logins since November 10 to probe repositories. It counted 4,837 hijacked accounts that opened a pull request, a proposed code change, in 61,764 repositories. The request only proves the account can write there. Aikido checked 1,500 probed repositories chosen at random. The payload ran in 10.6%, give or take 1.6 points, so about 6,500 overall is an estimate. In the same sample, 77% had nothing pushed after the probe and in 12% the infected workflow never ran.
The attacker undoes its change within a minute and deletes the run and logs. Aikido found the log gone in 156 of 159 such repositories. Aikido does not tie this wave to the October GhostAction actor. Many accounts overlap, but the tools and setup differ.
Write access to a repository works like a key to its cloud accounts. A workflow runs with the repository's secrets and cloud roles, so whoever edits one can read them. Aikido says 10,431 pull requests landed in repositories the account does not own, and 92% of those are still open. Cleanup erases the run log, so reviewing history finds little. Limit who can write, check for gaps in run numbers, and rotate every secret where the payload ran.