4,837 GitHub Accounts Hijacked in 'wfx-loot' Campaign to Harvest Cloud Credentials

What Happened

According to BleepingComputer, a campaign tracked as wfx-loot compromised 4,837 GitHub accounts, which attackers used to probe 61,764 repositories. The actors reportedly opened pull requests and pushed malware designed to steal secrets from affected projects.

Details beyond this are still emerging — the original reporting does not specify the initial access vector for the compromised accounts, the malware family involved, or confirmed downstream victims.

Why It Matters

At this scale, a single compromised-account technique chained with routine developer workflows (PRs, CI, repo secrets) becomes an efficient way to pivot from source code access into cloud credentials. Organizations that store cloud provider keys, API tokens, or service-account credentials in repository secrets, CI/CD configs, or committed config files are the ones most exposed if a pull request from a compromised account is merged or its contents executed by automation.

Any team that accepts external or third-party contributions, runs CI on pull requests automatically, or reuses long-lived cloud credentials inside repos should treat this as relevant.

What Defenders Should Watch For

• Audit recent pull requests and commits for unexpected file additions, obfuscated scripts, or changes to CI/CD workflow files (e.g. GitHub Actions YAML) from unfamiliar or recently active contributor accounts.
• Review GitHub organization audit logs for anomalous account activity — new SSH/PAT key additions, unusual login locations, or mass repository access by a single account.
• Check for exposed or long-lived cloud credentials (AWS/Azure/GCP keys) committed to repos or stored as CI secrets; rotate any that may have been exposed to untrusted automation.
• Enforce required review/approval before CI executes against pull requests from outside contributors, and restrict what secrets are available to PR-triggered workflows.
• Enable and monitor GitHub's secret-scanning and push-protection features as an early warning layer.

Developing Story

This is based on a single news report and details are still developing; attribution, full scope, and technical indicators have not been independently verified by df00tech. For the latest information, see the original report from BleepingComputer.