Threats · 7h ago
GitHub account hijacks put CI secrets at risk Aikido Security says an attacker used 4,837 hijacked GitHub accounts to plant a CI secret stealer that ran in at least 1,806 repositories. Separately, SafeDep counted malicious commits in 8,093 public repositories, searching only default branches.
The attacker first opened a test pull request to check whether an account could write to a repository, then added code to an automated build workflow. In some repositories, an npm postinstall hook could also run it when a developer installed packages. Changes were often reverted within minutes and run logs deleted. Where the stealer ran, it likely collected secrets and cloud credentials the workflow could access, so a clean-looking repository does not show those credentials stayed private.
Aikido says even accounts used only to open a test pull request may be compromised. For repositories whose workflows can read deployment secrets or assume cloud roles, the exposure can outlast the vanished commit.
Timeline Sources 5 sources covering this story
BleepingComputer Nov 12
Hackers compromise 4,800 GitHub accounts to steal cloud credentials
A new campaign dubbed 'wfx-loot' has unfolded on GitHub where threat actors used 4,837 compromised accounts to probe 61,764 repositories, open pull requests, and push secrets-stealing malware.
SecurityWeek Nov 12
Attacker Targets 60,000 GitHub Repositories in Credential Theft Campaign
Using thousands of hijacked accounts, the wfx-loot campaign planted a CI secret stealer that ran in over 1,800 GitHub repositories.
Help Net Security Nov 12
Check your GitHub repos: A secret stealer hit tens of thousands of them - Help Net Security
A GitHub Actions secret stealer spread through stolen tokens ran in more than 1,800 repositories, grabbing CI secrets and cloud credentials.
The Hacker News Nov 12
Attacker Used 4,837 Hijacked GitHub Accounts to Run a CI Secret Stealer in 1,806+ Repositories
Attackers used 4,837 stolen GitHub accounts to plant a CI secret stealer that ran in at least 1,806 repositories.
Semgrep Blog Nov 12
Seconds from Disaster: WFX Phantom and the CI Pipeline Nobody Was Watching
Between 10 and 12 November, an attacker used GitHub tokens stolen in earlier breaches to push a secret stealer into tens of thousands of repositories.
Part of the PlainSec briefing for 2026-11-13
Editions Related stories Threats · 7h ago
GitHub account hijacks put CI secrets at risk Aikido Security says an attacker used 4,837 hijacked GitHub accounts to plant a CI secret stealer that ran in at least 1,806 repositories. Separately, SafeDep counted malicious commits in 8,093 public repositories, searching only default branches.
The attacker first opened a test pull request to check whether an account could write to a repository, then added code to an automated build workflow. In some repositories, an npm postinstall hook could also run it when a developer installed packages. Changes were often reverted within minutes and run logs deleted. Where the stealer ran, it likely collected secrets and cloud credentials the workflow could access, so a clean-looking repository does not show those credentials stayed private.
Aikido says even accounts used only to open a test pull request may be compromised. For repositories whose workflows can read deployment secrets or assume cloud roles, the exposure can outlast the vanished commit.
Timeline Sources 5 sources covering this story
BleepingComputer Nov 12
Hackers compromise 4,800 GitHub accounts to steal cloud credentials
A new campaign dubbed 'wfx-loot' has unfolded on GitHub where threat actors used 4,837 compromised accounts to probe 61,764 repositories, open pull requests, and push secrets-stealing malware.
SecurityWeek Nov 12
Attacker Targets 60,000 GitHub Repositories in Credential Theft Campaign
Using thousands of hijacked accounts, the wfx-loot campaign planted a CI secret stealer that ran in over 1,800 GitHub repositories.
Help Net Security Nov 12
Check your GitHub repos: A secret stealer hit tens of thousands of them - Help Net Security
A GitHub Actions secret stealer spread through stolen tokens ran in more than 1,800 repositories, grabbing CI secrets and cloud credentials.
The Hacker News Nov 12
Attacker Used 4,837 Hijacked GitHub Accounts to Run a CI Secret Stealer in 1,806+ Repositories
Attackers used 4,837 stolen GitHub accounts to plant a CI secret stealer that ran in at least 1,806 repositories.
Semgrep Blog Nov 12
Seconds from Disaster: WFX Phantom and the CI Pipeline Nobody Was Watching
Between 10 and 12 November, an attacker used GitHub tokens stolen in earlier breaches to push a secret stealer into tens of thousands of repositories.
Part of the PlainSec briefing for 2026-11-13
Editions Related stories