Security researchers at Aikido Security have uncovered a large-scale credential theft campaign targeting more than 60,000 GitHub repositories using thousands of compromised developer accounts. The campaign, dubbed wfx-loot, began November 10 and has reportedly resulted in credential-stealing malware executing in at least 1,835 repositories.
Researchers identified approximately 4,800 compromised GitHub accounts used to test access to more than 61,000 repositories. Attackers then inserted malicious code into GitHub Actions workflows and installation scripts to steal repository secrets, cloud credentials and API keys, including those associated with AI services.
According to separate research from SafeDep, more than 8,000 repositories received malicious commits. The malware also contains capabilities to establish persistent access to AWS and Azure environments.
Attackers frequently reverted their changes and deleted workflow logs to conceal the activity, potentially leaving affected organizations unaware that credentials had been stolen.
ㅤRyan McCurdy, Vice President of Marketing, Liquibase
“The attackers didn’t need to exploit a GitHub Actions vulnerability. They used legitimate, compromised credentials to manipulate trusted development workflows and steal additional secrets.
“The fact that attackers could reverse their changes and delete execution logs makes this particularly concerning. A repository can look completely normal even after a malicious workflow has executed. That’s why organizations need visibility into what actually ran, not just what the code looks like today.
“This also raises an important question about how much authority we’re giving automated software delivery pipelines. If a compromised workflow has credentials that allow it to modify a production database, the consequences can extend well beyond credential theft.
“Enterprises need to limit those privileges, independently validate changes before they reach production, and maintain reliable audit evidence of what happened. Those controls shouldn’t depend entirely on trusting the pipeline executing the change.”
ㅤ
Seemant Sehgal, Founder & CEO, BreachLock
“Sixty thousand repositories got tested for access, and 1,835 ran the malware. That ratio tells you attackers treat developer accounts as a sorting exercise, where the compromised account is just the entry and the CI secrets sitting behind it are the prize. A workflow file with access to AWS and Azure credentials carries more privilege than most production admin accounts, and almost nobody reviews it with that level of scrutiny. The attackers reverted commits and deleted logs, so some teams are rotating nothing today because they have no idea anything was taken.”
ㅤWell, it seems lik ythis has all sorts of negative ramifications. I hope that companies keep that in mind when they read this.
Attackers target 60,000 GitHub repositories in credential theft campaign
Posted in Commentary with tags Akido Security, SaveDep on November 15, 2026 by itnerdSecurity researchers at Aikido Security have uncovered a large-scale credential theft campaign targeting more than 60,000 GitHub repositories using thousands of compromised developer accounts. The campaign, dubbed wfx-loot, began November 10 and has reportedly resulted in credential-stealing malware executing in at least 1,835 repositories.
Researchers identified approximately 4,800 compromised GitHub accounts used to test access to more than 61,000 repositories. Attackers then inserted malicious code into GitHub Actions workflows and installation scripts to steal repository secrets, cloud credentials and API keys, including those associated with AI services.
According to separate research from SafeDep, more than 8,000 repositories received malicious commits. The malware also contains capabilities to establish persistent access to AWS and Azure environments.
Attackers frequently reverted their changes and deleted workflow logs to conceal the activity, potentially leaving affected organizations unaware that credentials had been stolen.
ㅤRyan McCurdy, Vice President of Marketing, Liquibase
“The attackers didn’t need to exploit a GitHub Actions vulnerability. They used legitimate, compromised credentials to manipulate trusted development workflows and steal additional secrets.
“The fact that attackers could reverse their changes and delete execution logs makes this particularly concerning. A repository can look completely normal even after a malicious workflow has executed. That’s why organizations need visibility into what actually ran, not just what the code looks like today.
“This also raises an important question about how much authority we’re giving automated software delivery pipelines. If a compromised workflow has credentials that allow it to modify a production database, the consequences can extend well beyond credential theft.
“Enterprises need to limit those privileges, independently validate changes before they reach production, and maintain reliable audit evidence of what happened. Those controls shouldn’t depend entirely on trusting the pipeline executing the change.”
ㅤ
Seemant Sehgal, Founder & CEO, BreachLock
“Sixty thousand repositories got tested for access, and 1,835 ran the malware. That ratio tells you attackers treat developer accounts as a sorting exercise, where the compromised account is just the entry and the CI secrets sitting behind it are the prize. A workflow file with access to AWS and Azure credentials carries more privilege than most production admin accounts, and almost nobody reviews it with that level of scrutiny. The attackers reverted commits and deleted logs, so some teams are rotating nothing today because they have no idea anything was taken.”
ㅤWell, it seems lik ythis has all sorts of negative ramifications. I hope that companies keep that in mind when they read this.
Leave a comment »