Science & Tech · Cybersecurity · 22 hrs ago
GitHub credential theft campaign probes more than 61,000 repositories
A campaign called wfx-loot used stolen access from about 4,800 GitHub accounts to test more than 61,000 repositories for permission to make changes.
It began on November 10 and targeted projects on GitHub, a platform used to store and develop software.
The attacker sent pull requests disguised as dependency audit notes, then added malicious code where access and settings allowed it.
The code stole GitHub, cloud and developer credentials, including keys used by services such as AWS, Azure and Google Cloud.
Aikido confirmed that the code ran in at least 1,835 targets, while another firm counted more than 8,000 public repositories with malicious commits; those commits do not prove the code ran.
The campaign also affected releases of a Packagist package and two Go modules, and researchers found similarities to an earlier campaign but said the operations probably had different actors.
Organizations should revoke tokens and rotate exposed secrets if the code ran, and check for unauthorized cloud changes.
A campaign called wfx-loot used stolen GitHub credentials to probe 61,764 repositories for write access.
Aikido said the campaign began on November 10 and involved 4,837 compromised accounts.
Researchers confirmed the credential-stealing payload ran in at least 1,835 targets, while SafeDep counted 8,093 public repositories that received malicious commits.
The malware sought GitHub, cloud, developer-tool and AI service credentials, and could support expanded or persistent access to cloud accounts.
Researchers said the attacker usually reversed changes and deleted workflow runs to conceal the activity.
- Who
- An attacker using stolen credentials from thousands of compromised GitHub accounts.
- What
- A campaign called wfx-loot probed repositories and inserted code designed to steal credentials.
- When
- It began around 12:45 UTC on November 10; the articles were published on November 12, 2026.
- Where
- GitHub repositories, with affected software releases also identified on Packagist and in Go modules.
- Why
- Aikido assessed that the primary objective was stealing CI secrets and cloud credentials.
This story does not have two clearly opposing sides.
Aikido said the wfx-loot campaign began, using stolen credentials to probe repositories for write access.
The attacker inserted credential-stealing code in repositories where permissions and configuration allowed it to run.
The attacker usually reversed code changes and deleted workflow runs; Aikido said this was completed in under a minute.
- Repositories probed
- 61,764
- Compromised accounts
- 4,837
- Confirmed targets with stolen secrets
- At least 1,835
- Public repositories with malicious commits
- 8,093, according to SafeDep
- Packagist release
- digitalelvis/neuronai-studio 3.14.3
- Go module releases
- github.com/onuragtas/docker-env v1.0.278 and v1.0.280
3 sources
What people are saying
The pull request does nothing by itself
The attacker does not exploit a bug in GitHub Actions