Check your GitHub repos: A secret stealer hit tens of thousands of them
Threat actor wfx-loot targets GitHub repos with stolen credentials, stealing secrets from thousands.
A threat actor, named wfx-loot, has compromised tens of thousands of GitHub repositories using stolen credentials since November 10. The malware has executed in over 1,800 repositories, exfiltrating GitHub Actions secrets and cloud credentials. The campaign targets CI secrets and has been observed injecting payloads into package repositories.
AI summary of the linked source. Not reviewed by an editor. How this works
Run GitHub?
Get an email when a new story names GitHub, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe wfx-loot campaign exploited stolen credentials to access tens of thousands of GitHub repositories, executing malicious payloads in over 1,800 of them and exfiltrating GitHub Actions secrets and cloud credentials. The root issue is that CI/CD pipeline secrets were overly permissive, long-lived, and insufficiently protected, making them high-value targets once initial access was gained. Injecting payloads into package repositories further amplifies the risk by potentially poisoning downstream software supply chains. This incident demonstrates how a single set of compromised credentials in a CI/CD environment can cascade into widespread secret theft and software integrity compromise.
What helps against this
How we list vendors
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — wfx