Reported by 2 outlets
The story so far
AI summary of the reporting below · Updated · How we work
A widespread credential-stealing campaign dubbed wfx-loot targeted tens of thousands of GitHub repositories to extract development secrets and cloud tokens. Application security firm Aikido reports that the assault started around 12:45 UTC on November 10, when attackers leveraged 4,837 hijacked accounts to probe 61,764 repositories for write privileges. Security researchers confirmed that the perpetrators successfully stole secrets from at least 1,835 target repositories, including accounts tied to Fortune 100 firms, the French government, the US General Services Administration, Nextcloud, and WebdriverIO. [1][2]
The threat actors opened probe pull requests labeled "docs: dependency audit notes" to test access before deploying a 1,500-line shell script via modified workflows, short-lived branches, or npm hooks. The payload targeted AWS, Azure, and Google Cloud credentials, along with AI tokens for OpenAI, Anthropic, Gemini, and Cursor, as well as developer keys for Docker, Kubernetes, and SSH. The script also exchanged GitHub OIDC tokens to escalate privileges into cloud sessions, tarballed the stolen data, sent it to attacker-controlled endpoints, and deleted workflow logs in under a minute to cover its tracks. [1]
With 92% of the probe pull requests still unaddressed by repository owners, Aikido advises maintainers to check for lingering "wfx-docs" branches and immediately rotate any cloud roles and secrets exposed to affected CI workflows. [1]
A new campaign dubbed 'wfx-loot' has unfolded on GitHub where threat actors used 4,837 compromised accounts to probe 61,764 repositories, open pull requests, and push secrets-stealing malware.
via BleepingComputer
Using thousands of hijacked accounts, the wfx-loot campaign planted a CI secret stealer that ran in over 1,800 GitHub repositories.
via SecurityWeek