Hackers Use 4,837 Stolen GitHub Accounts to Target 61,764 Repositories
Hackers used 4,837 stolen GitHub accounts to target 61,764 repositories in the wfx-loot campaign.
The wfx-loot campaign utilized 4,837 compromised GitHub accounts to target 61,764 repositories, aiming to steal developer credentials, cloud keys, and tokens. Researchers confirmed malware successfully stole secrets from at least 1,835 repositories. Attackers used pull requests to test stolen access, followed by malicious commits disguised as routine maintenance, employing various delivery methods including GitHub Actions, npm hooks, and shell scripts.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Aikido Security?
Get an email when a new story names Aikido Security, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe wfx-loot campaign exploited 4,837 stolen GitHub accounts to inject malicious code into tens of thousands of repositories via pull requests and commits disguised as routine maintenance. Attackers harvested developer credentials, cloud API keys, and tokens from at least 1,835 repositories, demonstrating how credential compromise at scale can silently corrupt the software supply chain. Because developers inherently trust familiar workflows like pull requests and GitHub Actions, malicious contributions blended in without raising immediate suspicion. This matters because secrets stolen from developer repositories can cascade into production cloud environments, enabling further breaches far beyond the original repositories.
What helps against this
How we list vendors
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — wfx-loot