#10
BleepingComputer
general
November 12, 2026 at 22:25 UTC
Hackers compromise 4,800 GitHub accounts to steal cloud credentials
By Bill Toulas
AI Summary
A campaign dubbed 'wfx-loot' used 4,837 compromised GitHub accounts to open malicious pull requests across 61,764 repositories, injecting secrets-stealing malware into CI/CD pipelines that executed in over 1,800 repositories. The attack targeted cloud credentials stored as GitHub Actions secrets. Security teams should audit GitHub Actions workflows for unauthorized modifications, rotate exposed secrets, and enforce branch protection rules to limit pull request abuse.
Relevance score: 79.0/100
Sponsored
Protect Your Business
Expert cybersecurity solutions to safeguard your organization from evolving threats.
Get Protected →