[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fks17iSFNJNC3meJF3Mp7mzDK06ImYfMpZL7RjHLpT2g":3},{"article":4,"iocs":49,"watch_terms":53,"solutions":54,"lesson":144},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"49d8a860-b646-4ed6-bc9e-9a96e4244157","Attacker Targets 60,000 GitHub Repositories in Credential Theft Campaign","attacker-targets-60-000-github-repositories-in-credential-theft-campaign-92fa12","Using thousands of hijacked accounts, the wfx-loot campaign planted a CI secret stealer that ran in over 1,800 GitHub repositories. The post Attacker Targets 60,000 GitHub Repositories in Credential Theft Campaign appeared first on SecurityWeek.","An attacker, dubbed wfx-loot, has compromised over 60,000 GitHub repositories using thousands of hijacked developer and bot accounts. The campaign planted credential-stealing code in over 1,800 repositories by inserting it into GitHub Actions workflows, shell scripts, and npm hooks. The malware seeks GitHub tokens, cloud credentials, and AI service keys, with functionality to expand access in AWS and Azure.","Attacker targets 60,000 GitHub repos with credential-stealing malware via hijacked accounts.","https:\u002F\u002Fwww.securityweek.com\u002Fattacker-targets-60000-github-repositories-in-credential-theft-campaign\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2023\u002F04\u002FLow-Code-No-Code-Security.jpg","2026-11-12T13:39:03+00:00","2026-11-12T14:00:18.701778+00:00",9,[17,20,23],{"name":18,"type":19},"wfx-loot","threat_actor",{"name":21,"type":22},"GitHub Actions","product",{"name":24,"type":25},"npm","technology","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":26,"icon":28,"name":29,"slug":30},null,"Threat Intelligence","threat-intelligence",[32,37,42,47],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":38},{"id":39,"icon":28,"name":40,"slug":41},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":43},{"id":44,"icon":28,"name":45,"slug":46},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":48},{"id":26,"icon":28,"name":29,"slug":30},[50],{"type":41,"value":51,"context":52},"CI secret stealer","Type of malware deployed in GitHub repositories",[21],{"controls":55,"vendors":137},[56,85,114],{"slug":57,"name":58,"problem":59,"products":60},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[61,69,77],{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"slug":86,"name":87,"problem":88,"products":89},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[90,98,106],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"slug":115,"name":116,"problem":117,"products":118},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[119,124,132],{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":120,"product_name":121,"url":122,"description":123},"cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":133,"product_name":134,"url":135,"description":136},"falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",[138],{"slug":139,"name":140,"logo_path":141,"roles":142},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png",[143],"affected",{"slug":145,"title":146,"body":147,"framework_refs":148,"framework_notes":154},"60000-github-repos-poisoned-via-hijacked-accounts-and-workflow-injection","60,000 GitHub Repos Poisoned via Hijacked Accounts and Workflow Injection","The attacker compromised thousands of developer and bot accounts to inject credential-stealing code directly into GitHub Actions workflows, shell scripts, and npm hooks — trusted components of the software development pipeline. This is a classic supply chain attack: by targeting the build and automation layer rather than production systems directly, the attacker harvested GitHub tokens, cloud credentials, and AI service keys at scale. The incident highlights how overprivileged bot accounts and poorly reviewed CI\u002FCD configurations create a massive attack surface. When credentials stolen from one repository can pivot into AWS or Azure environments, the blast radius extends far beyond source code.",[149,150,151,152,153],"MITRE ATT&CK T1195.001: Supply Chain Compromise: Compromise Software Dependencies and Development Tools","CIS Control 16: Application Software Security (v8)","NIST SP 800-53 SA-12: Supply Chain Protection","NIS2 Article 21(2)(d)","NIS2 Article 21(2)(j)",{"NIS2 Article 21(2)(d)":155,"NIS2 Article 21(2)(j)":156,"NIST SP 800-53 SA-12: Supply Chain Protection":157,"CIS Control 16: Application Software Security (v8)":158,"MITRE ATT&CK T1195.001: Supply Chain Compromise: Compromise Software Dependencies and Development Tools":159},"NIS2's supply chain security point requires managing security risks introduced by third-party developers and software suppliers, which applies here because hijacked developer accounts were used to poison shared repositories.","Requiring multi-factor authentication on developer and bot accounts would have made it significantly harder for the attacker to hijack the thousands of accounts used to plant malicious code.","SA-12 requires organizations to protect against supply chain threats in software and development tools, directly addressing the risk of attacker-injected code in shared repository workflows.","CIS Control 16 requires securing software development pipelines and reviewing code for malicious content, which would have detected unauthorized insertions into CI\u002FCD workflow files.","The attacker injected malicious code into GitHub Actions workflows and npm hooks — development tooling — to compromise downstream consumers of those repositories, which is exactly what this technique describes."]