[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fKmMm2iYRs6W0xd7vVy56gaNnrV3oOe7AnFlhQB1n3Os":3},{"article":4,"iocs":56,"watch_terms":59,"solutions":60,"lesson":149},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"1f01af99-119a-40bd-ad8c-8b930a431082","Hackers Use 4,837 Stolen GitHub Accounts to Target 61,764 Repositories","hackers-use-4-837-stolen-github-accounts-to-target-61-764-repositories-318bd2","Hackers used 4,837 compromised GitHub accounts in the wfx-loot campaign to target repositories and steal developer credentials, cloud…","The wfx-loot campaign utilized 4,837 compromised GitHub accounts to target 61,764 repositories, aiming to steal developer credentials, cloud keys, and tokens. Researchers confirmed malware successfully stole secrets from at least 1,835 repositories. Attackers used pull requests to test stolen access, followed by malicious commits disguised as routine maintenance, employing various delivery methods including GitHub Actions, npm hooks, and shell scripts.","Hackers used 4,837 stolen GitHub accounts to target 61,764 repositories in the wfx-loot campaign.","https:\u002F\u002Fhackread.com\u002Fhackers-stolen-github-accounts-target-repositories\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002Fhackers-stolen-github-accounts-target-repositories.jpg","2026-11-13T09:41:06+00:00","2026-11-13T10:00:35.674923+00:00",8,[17,20,23,25,28,30],{"name":18,"type":19},"wfx-loot","campaign",{"name":21,"type":22},"Aikido Security","vendor",{"name":24,"type":22},"StepSecurity",{"name":26,"type":27},"GitHub","product",{"name":29,"type":27},"Fly.io",{"name":31,"type":32},"GitHub Actions","technology","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":33,"icon":35,"name":36,"slug":37},null,"Supply Chain","supply-chain",[39,41,46,51],{"category":40},{"id":33,"icon":35,"name":36,"slug":37},{"category":42},{"id":43,"icon":35,"name":44,"slug":45},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":47},{"id":48,"icon":35,"name":49,"slug":50},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":52},{"id":53,"icon":35,"name":54,"slug":55},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[57],{"type":45,"value":18,"context":58},"Name of the campaign and associated malware",[21,24,26],{"controls":61,"vendors":143},[62,91,120],{"slug":63,"name":64,"problem":65,"products":66},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[67,75,83],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"slug":92,"name":93,"problem":94,"products":95},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[96,104,112],{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"slug":121,"name":122,"problem":123,"products":124},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[125,130,135],{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":126,"product_name":127,"url":128,"description":129},"cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":131,"product_name":132,"url":133,"description":134},"managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",[144],{"slug":145,"name":26,"logo_path":146,"roles":147},"github","\u002Fvendor-logos\u002Fgithub.png",[148],"affected",{"slug":150,"title":151,"body":152,"framework_refs":153,"framework_notes":159},"compromised-github-accounts-weaponized-to-poison-thousands-of-repositories","Compromised GitHub Accounts Weaponized to Poison Thousands of Repositories","The wfx-loot campaign exploited 4,837 stolen GitHub accounts to inject malicious code into tens of thousands of repositories via pull requests and commits disguised as routine maintenance. Attackers harvested developer credentials, cloud API keys, and tokens from at least 1,835 repositories, demonstrating how credential compromise at scale can silently corrupt the software supply chain. Because developers inherently trust familiar workflows like pull requests and GitHub Actions, malicious contributions blended in without raising immediate suspicion. This matters because secrets stolen from developer repositories can cascade into production cloud environments, enabling further breaches far beyond the original repositories.",[154,155,156,157,158],"MITRE ATT&CK T1195.001: Supply Chain Compromise: Compromise Software Dependencies and Development Tools","NIST CSF 2.0 PR.AA-02: Identity management, authentication, and access control","CIS Control 14: Security Awareness and Skills Training (v8)","NIS2 Article 21(2)(i)","NIST SP 800-53 IA-5: Authenticator Management",{"NIS2 Article 21(2)(i)":160,"NIST SP 800-53 IA-5: Authenticator Management":161,"CIS Control 14: Security Awareness and Skills Training (v8)":162,"NIST CSF 2.0 PR.AA-02: Identity management, authentication, and access control":163,"MITRE ATT&CK T1195.001: Supply Chain Compromise: Compromise Software Dependencies and Development Tools":164},"This point requires organizations to implement access control and human resources security policies that would mandate MFA and least-privilege access for developer accounts handling sensitive repositories.","Proper authenticator management—including prohibiting storage of credentials in code and enforcing MFA—would have limited attackers' ability to leverage stolen GitHub account credentials at scale.","Developers trained to scrutinize unfamiliar pull requests and avoid storing secrets in repositories would have reduced both the attack surface and the volume of successfully exfiltrated credentials.","Enforcing MFA and strong identity verification for GitHub accounts would have prevented stolen credentials from being used to authenticate and make malicious contributions.","Attackers injected malicious commits and Actions workflows into repositories to compromise downstream consumers of that code, which is precisely what this technique describes."]