[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fm4g8ASvwm1NKM3grKPBUEEcPmb6XQIwf1EqnNzsaKS4":3},{"article":4,"iocs":55,"watch_terms":58,"solutions":59,"lesson":148},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"f30c0335-6837-48c3-b462-1019b938c121","Hackers compromise 4,800 GitHub accounts to steal cloud credentials","hackers-compromise-4-800-github-accounts-to-steal-cloud-credentials-ec46d2","A new campaign dubbed 'wfx-loot' has unfolded on GitHub where threat actors used 4,837 compromised accounts to probe 61,764 repositories, open pull requests, and push secrets-stealing malware. [...]","A campaign named 'wfx-loot' utilized 4,837 compromised GitHub accounts to probe 61,764 repositories, aiming to steal GitHub Actions secrets and cloud credentials. The threat actor successfully exfiltrated secrets from at least 1,835 targets by injecting a credential-stealing shell script into GitHub Actions workflows. The campaign also involved automated publishing of malicious code into package ecosystems like Packagist and Go modules.","Hackers used 4,800 compromised GitHub accounts in the 'wfx-loot' campaign to steal cloud credentials.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackers-compromise-4-800-github-accounts-to-steal-cloud-credentials\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F10\u002F08\u002Fgithub.jpg","2026-11-12T22:25:30+00:00","2026-11-12T23:00:10.184203+00:00",8,[17,20,23,26,28,30],{"name":18,"type":19},"wfx-loot","campaign",{"name":21,"type":22},"GitHub","vendor",{"name":24,"type":25},"GitHub Actions","technology",{"name":27,"type":25},"AWS",{"name":29,"type":25},"Azure",{"name":31,"type":25},"Google Cloud","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":32,"icon":34,"name":35,"slug":36},null,"Threat Intelligence","threat-intelligence",[38,43,48,53],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":54},{"id":32,"icon":34,"name":35,"slug":36},[56],{"type":47,"value":18,"context":57},"Name of the campaign and associated malicious workflows.",[21],{"controls":60,"vendors":142},[61,90,119],{"slug":62,"name":63,"problem":64,"products":65},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[66,74,82],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"slug":91,"name":92,"problem":93,"products":94},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[95,103,111],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"slug":120,"name":121,"problem":122,"products":123},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[124,132,137],{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":133,"product_name":134,"url":135,"description":136},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":138,"product_name":139,"url":140,"description":141},"falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",[143],{"slug":144,"name":21,"logo_path":145,"roles":146},"github","\u002Fvendor-logos\u002Fgithub.png",[147],"affected",{"slug":149,"title":150,"body":151,"framework_refs":152,"framework_notes":157},"compromised-github-accounts-used-to-steal-cloud-secrets-via-injected-cicd-workflows","Compromised GitHub Accounts Used to Steal Cloud Secrets via Injected CI\u002FCD Workflows","Attackers leveraged nearly 4,837 compromised GitHub accounts to inject malicious shell scripts into GitHub Actions workflows, targeting secrets stored in CI\u002FCD pipelines and exfiltrating cloud credentials from over 1,800 repositories. The root issue is a combination of inadequate protection of GitHub Actions secrets and insufficient account security controls (such as weak or reused credentials enabling mass account compromise). This matters because CI\u002FCD pipelines often hold privileged cloud credentials, making them a high-value target that can cascade into full cloud environment compromise. The secondary threat — automatic publishing of malicious packages to Packagist and Go module registries — demonstrates how a single compromised CI\u002FCD environment can poison downstream supply chains at scale.",[153,154,155,156],"MITRE ATT&CK T1552.001: Credentials in Files","NIST SP 800-53 IA-5: Authenticator Management","NIS2 Article 21(2)(d)","NIST CSF 2.0 DE.CM-01: Continuous Monitoring",{"NIS2 Article 21(2)(d)":158,"MITRE ATT&CK T1552.001: Credentials in Files":159,"NIST CSF 2.0 DE.CM-01: Continuous Monitoring":160,"NIST SP 800-53 IA-5: Authenticator Management":161},"The malicious injection of code into Packagist and Go module registries via compromised pipelines is a supply chain security risk that NIS2's supply chain point directly addresses.","Attackers specifically targeted secrets stored in GitHub Actions workflow files and repository configurations to harvest cloud credentials.","Continuous monitoring of CI\u002FCD workflow executions and secret access patterns would have enabled earlier detection of the credential-exfiltrating shell scripts being injected and run.","Proper authenticator management — including MFA enforcement and rotation of compromised credentials — would have reduced the risk of mass account compromise used to seed this campaign."]