> TritonInfoSec News
Home / Nov 13, 2026 / Story
0
#9 The Hacker News general November 12, 2026 at 06:42 UTC

Attacker Used 4,837 Hijacked GitHub Accounts to Run a CI Secret Stealer in 1,806+ Repositories

By [email protected] (The Hacker News)

AI Summary

In the 'wfx-loot' campaign, an attacker leveraged credentials from 4,837 hijacked GitHub accounts to plant a CI secrets stealer across at least 1,806 repositories, targeting cloud credentials and CI/CD pipeline secrets. The campaign probed 61,764 repositories by opening pull requests and pushing malicious code, posing a significant supply-chain risk to organizations using GitHub Actions.

Read full article → https://thehackernews.com/2026/11/4837-hijacked-gi…

Relevance score: 76.0/100

# More from November 13

  1. 1
    Hackers Exploit N-central Flaws to Infect 21 Servers, Including 19 Running Hotfix 2 The Hacker News
  2. 2
    New N-able "4EverAble2Shell" zero-day exploited hours after PoC released BleepingComputer
  3. 3
    US seizes North Korean hacking infrastructure, $1.2 billion in cryptocurrency stolen from Binance CyberScoop
  4. 4
    Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely The Hacker News
  5. 5
    International operation dismantles malware networks, exposes 6.4 million stolen credentials CyberScoop
  6. 6
    ScreenConnect Attacks Target at Least 288 Endpoints Across 48 Organizations With Rogue Clients The Hacker News
  7. 7
    Citrix Patches 12 NetScaler and Secure Access Client Flaws, Including Authentication Bypass The Hacker News
  8. 8
    New Windows SignDrop zero-day gives hackers SYSTEM privileges BleepingComputer
  9. 10
    AntiFox AI Pentesting Platform Linked to Attacks That Accessed AWS Production Secrets The Hacker News