Aikido Security says an attacker used 4,837 hijacked GitHub accounts to plant a CI secret stealer that ran in at least 1,806 repositories. Separately, SafeDep counted malicious commits in 8,093 public repositories, searching only default branches.
The attacker first opened a test pull request to check whether an account could write to a repository, then added code to an automated build workflow. In some repositories, an npm postinstall hook could also run it when a developer installed packages. Changes were often reverted within minutes and run logs deleted. Where the stealer ran, it likely collected secrets and cloud credentials the workflow could access, so a clean-looking repository does not show those credentials stayed private.
Aikido says even accounts used only to open a test pull request may be compromised. For repositories whose workflows can read deployment secrets or assume cloud roles, the exposure can outlast the vanished commit.
Hackers compromise 4,800 GitHub accounts to steal cloud credentials
A new campaign dubbed 'wfx-loot' has unfolded on GitHub where threat actors used 4,837 compromised accounts to probe 61,764 repositories, open pull requests, and push secrets-stealing malware.