Attacker Targets 60,000 GitHub Repositories in Credential Theft Campaign

The wfx-loot campaign involved attackers using thousands of hijacked GitHub accounts to test and deploy a credential-stealing malware in over 1,800 repositories. The malware was inserted into GitHub Actions workflows, shell scripts, and npm installation hooks to steal GitHub tokens, repository secrets, cloud credentials, and AI service keys. The attacker used valid tokens rather than exploiting GitHub vulnerabilities and concealed their activity by reversing code changes and deleting workflow runs. Organizations affected should assume all accessible secrets were compromised and take action to revoke and rotate credentials.

• securityweek.com/attacker-targets-60000-github-repositories-in-credential-theft-campaign/ (opens in a new tab)