[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fa3D2LpOiwvgb1SsG-PQqE4IWJGdhUDiKYFcdXFhPQWg":3},{"article":4,"iocs":56,"watch_terms":60,"solutions":61,"lesson":150},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"5dc29633-1965-4dc4-85c6-724677a49504","Check your GitHub repos: A secret stealer hit tens of thousands of them","check-your-github-repos-a-secret-stealer-hit-tens-of-thousands-of-them-855e21","A threat actor using stolen GitHub credentials has pushed a credential-stealing payload into tens of thousands of repositories since November 10. In more than 1,800 of them, the malware ran and shipped GitHub Actions secrets and cloud credentials to the attacker. Aikido spotted the campaign and named it wfx-loot. The name comes from the attacker’s own labels, “wfx” for the malware and “loot” for what it steals. Aikido counted 4,837 compromised accounts opening probe pull … More → The post Check your GitHub repos: A secret stealer hit tens of thousands of them appeared first on Help Net Security.","A threat actor, named wfx-loot, has compromised tens of thousands of GitHub repositories using stolen credentials since November 10. The malware has executed in over 1,800 repositories, exfiltrating GitHub Actions secrets and cloud credentials. The campaign targets CI secrets and has been observed injecting payloads into package repositories.","Threat actor wfx-loot targets GitHub repos with stolen credentials, stealing secrets from thousands.","https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F11\u002F12\u002Fwfx-loot-github-actions-secret-stealer\u002F","https:\u002F\u002Fimg.helpnetsecurity.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002F12102048\u002Fgithub-red-danger-1500.webp","2026-11-12T09:24:32+00:00","2026-11-12T10:00:15.117848+00:00",9,[17,20,23,26,29,31],{"name":18,"type":19},"wfx-loot","threat_actor",{"name":21,"type":22},"GitHub","vendor",{"name":24,"type":25},"GitHub Actions","product",{"name":27,"type":28},"AWS","technology",{"name":30,"type":28},"GCP",{"name":32,"type":28},"Azure","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":33,"icon":35,"name":36,"slug":37},null,"Supply Chain","supply-chain",[39,41,46,51],{"category":40},{"id":33,"icon":35,"name":36,"slug":37},{"category":42},{"id":43,"icon":35,"name":44,"slug":45},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":47},{"id":48,"icon":35,"name":49,"slug":50},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":52},{"id":53,"icon":35,"name":54,"slug":55},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[57],{"type":45,"value":58,"context":59},"wfx","Malware name used by the threat actor.",[21,24],{"controls":62,"vendors":146},[63,92,120],{"slug":64,"name":65,"problem":66,"products":67},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[68,76,84],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"slug":93,"name":94,"problem":95,"products":96},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[97,105,113],{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"vendor_slug":114,"vendor_name":21,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"github","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"slug":121,"name":122,"problem":123,"products":124},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[125,130,138],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":126,"product_name":127,"url":128,"description":129},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",[147],{"slug":114,"name":21,"logo_path":115,"roles":148},[149],"affected",{"slug":151,"title":152,"body":153,"framework_refs":154,"framework_notes":160},"stolen-cicd-credentials-enable-mass-github-repository-compromise","Stolen CI\u002FCD Credentials Enable Mass GitHub Repository Compromise","The wfx-loot campaign exploited stolen credentials to access tens of thousands of GitHub repositories, executing malicious payloads in over 1,800 of them and exfiltrating GitHub Actions secrets and cloud credentials. The root issue is that CI\u002FCD pipeline secrets were overly permissive, long-lived, and insufficiently protected, making them high-value targets once initial access was gained. Injecting payloads into package repositories further amplifies the risk by potentially poisoning downstream software supply chains. This incident demonstrates how a single set of compromised credentials in a CI\u002FCD environment can cascade into widespread secret theft and software integrity compromise.",[155,156,157,158,159],"CIS Control 5: Account Management","NIST SP 800-53 IA-5: Authenticator Management","NIST CSF 2.0 PR.AA-05: Access permissions and authorizations","MITRE ATT&CK T1552.001: Credentials In Files","NIS2 Article 21(2)(i)",{"NIS2 Article 21(2)(i)":161,"CIS Control 5: Account Management":162,"MITRE ATT&CK T1552.001: Credentials In Files":163,"NIST SP 800-53 IA-5: Authenticator Management":164,"NIST CSF 2.0 PR.AA-05: Access permissions and authorizations":165},"This point covers access control and asset management, requiring organizations to protect credentials and manage access to critical systems like CI\u002FCD pipelines, directly relevant to the secret theft in this incident.","This control requires managing the lifecycle of credentials and enforcing least-privilege access; applying it would have limited the blast radius of the stolen credentials used to access repositories.","The attackers specifically targeted secrets stored within GitHub Actions workflows and repository configurations, which this technique describes.","IA-5 requires protecting and rotating authenticators such as tokens and secrets; enforcing short-lived credentials would have prevented the sustained exploitation seen in this campaign.","This category calls for managing access permissions so that credentials are scoped and revoked appropriately, which would have contained the damage from the stolen GitHub credentials."]