Hackers Compromise 4,800 GitHub Accounts to Steal Cloud Credentials
Researchers say the campaign used 4,837 compromised accounts and stole secrets from at least 1,835 targets before attackers deleted logs.
- Aikido researchers report that a campaign dubbed wfx-loot began around 12:45 UTC on November 10, using stolen GitHub credentials from 4,837 compromised accounts to probe 61,764 repositories for write access.
- Attackers opened pull requests disguised as "docs: dependency audit notes," then delivered a 1,500-line credential-stealing shell script by modifying existing GitHub Actions workflows to inject malicious code.
- Researchers confirmed the threat actor stole secrets from at least 1,835 targets, including Fortune 100 organizations, the US General Services Administration, the French government, Nextcloud, and WebdriverIO.
- The script exfiltrated cloud credentials for AWS, Azure, and Google Cloud, using OIDC tokens to escalate privileges and chain into IAM roles "to create long-lived credentials for IAM users."
- GitHub repository owners should immediately rotate all secrets and look for gaps in workflow run numbers; the attacker attempted to hide by deleting logs and reverting changes within minutes.
19 Articles
19 Articles
Thousands of GitHub repos hit with secret-stealing malware
Researchers have uncovered a campaign in which hijacked GitHub accounts spread secret-stealing malware across thousands of repositories. The payload executed in at least 1,806 repos, exfiltrating CI/CD secrets and cloud credentials. Aikido Security, which detected and documented the campaign, said the attackers used the 4,837 compromised accounts to open probe pull requests in 61,764 repositories starting Nov. 10. Around 92% of those pull reques…
المعنال عبر Cedarnews.net. لمابعة المبيد من البار والبارير العرية وورونا علا موععنا. The collaborative development platform GitHub has been the target of a sophisticated cyberattack campaign. مم نر البر عبر موةع Cedarnews الباباريي. لالاباع علن مبيد ميد من مالببالارة الابارير العرية العرواالرسمي.
Large—scale hacking of GitHub - more than 60 thousand repositories were hit, hackers claim
Large—scale hacking of GitHub - more than 60 thousand repositories were hit, hackers claim. Even accounts linked to government agencies in the United States and France were at risk of leaks.According to preliminary data, the hackers used a secretive...
Hackers compromise 4,800 GitHub accounts to steal cloud credentials
A new campaign dubbed 'wfx-loot' has unfolded on GitHub where threat actors used 4,837 compromised accounts to probe 61,764 repositories, open pull requests, and push secrets-stealing malware.
Aikido cyber experts found that on November 10, an attacker stole passwords and access keys from at least 1,835 projects on the GitHub developer platform.
Coverage Details
Bias Distribution
- 80% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
