wfx-loot Operation: Attacker Probes 60,000 GitHub Repositories for Credential Theft
An attacker tested stolen access across more than 60,000 GitHub repositories and inserted credential-stealing code in thousands of them. Security firms Aikido Security, StepSecurity, and SafeDep tracked the wfx-loot campaign that began on November 10. The operation relied on valid tokens from developer and bot accounts rather than any GitHub Actions vulnerability. Malware was deployed via existing or new workflows, CI shell scripts, and npm installation hooks, targeting tokens, secrets, cloud credentials, and AI service keys. The script also read GitHub Actions runner memory and attempted persistence in AWS and Azure environments. Affected releases include one Packagist package and versions of two Go modules. Organizations are advised to revoke compromised tokens and rotate exposed secrets.
SecurityWeekNov 12, 2026Translated from English