Hackers compromise 4,800 GitHub accounts to steal cloud credentials
Hackers used 4,800 compromised GitHub accounts in the 'wfx-loot' campaign to steal cloud credentials.
A campaign named 'wfx-loot' utilized 4,837 compromised GitHub accounts to probe 61,764 repositories, aiming to steal GitHub Actions secrets and cloud credentials. The threat actor successfully exfiltrated secrets from at least 1,835 targets by injecting a credential-stealing shell script into GitHub Actions workflows. The campaign also involved automated publishing of malicious code into package ecosystems like Packagist and Go modules.
AI summary of the linked source. Not reviewed by an editor. How this works
Run GitHub?
Get an email when a new story names GitHub, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers leveraged nearly 4,837 compromised GitHub accounts to inject malicious shell scripts into GitHub Actions workflows, targeting secrets stored in CI/CD pipelines and exfiltrating cloud credentials from over 1,800 repositories. The root issue is a combination of inadequate protection of GitHub Actions secrets and insufficient account security controls (such as weak or reused credentials enabling mass account compromise). This matters because CI/CD pipelines often hold privileged cloud credentials, making them a high-value target that can cascade into full cloud environment compromise. The secondary threat — automatic publishing of malicious packages to Packagist and Go module registries — demonstrates how a single compromised CI/CD environment can poison downstream supply chains at scale.
What helps against this
How we list vendors
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — wfx-loot