Hackers Hijack 4,837 GitHub Accounts to Target 61,764 Repositories With CI Secret-Stealing Malware
Hackers hijacked 4,837 GitHub accounts to inject secret-stealing malware into 61,764 repositories.
A threat actor used stolen GitHub credentials to inject a secret-stealing malware, named 'wfx', into over 61,000 repositories. The malware targets CI secrets and cloud keys within GitHub Actions, with at least 1,806 repositories running the payload and losing credentials. Researchers noted the attacker's focus on CI secrets rather than a broad supply chain compromise, though some packages were affected.
AI summary of the linked source. Not reviewed by an editor. How this works
Run GitHub Actions?
Get an email when a new story names GitHub Actions, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers used compromised GitHub account credentials to inject a secret-stealing malware ('wfx') into over 61,000 repositories, targeting CI/CD pipeline secrets and cloud keys embedded in GitHub Actions workflows. The root cause is a combination of weak or reused credentials enabling account takeover and secrets being stored insecurely within CI environments where injected code could harvest them. This matters because CI/CD pipelines have privileged access to production infrastructure, cloud accounts, and downstream packages, meaning stolen CI secrets can cascade into full cloud environment compromises. The incident underscores that protecting source code repositories requires both strong authentication on developer accounts and secrets hygiene within pipeline configurations.
What helps against this
How we list vendors
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — wfx