A massive credential theft campaign has been unfolding on GitHub, with an attacker exploiting valid tokens belonging to developer and bot accounts to insert malicious code into thousands of repositories. The operation, dubbed “wfx-loot” by Aikido Security, has compromised over 60,000 GitHub repositories, highlighting the importance of robust cybersecurity practices in the development ecosystem.
The attacker’s modus operandi involves submitting probe pull requests to test whether stolen access permits changes to a repository. If permissions and configuration allow it, malware is subsequently deployed, compromising sensitive data such as GitHub tokens, repository secrets, cloud credentials, and AI service keys. The script also reads GitHub Actions runner process memory and has functionality designed to expand access and establish persistence in AWS and Azure.
According to Aikido Security, the attacker typically reversed code changes and deleted workflow runs to conceal their activity, making it challenging for developers to detect the breach. Notably, StepSecurity traced 173 probe pull requests to tokens issued to the Fly.io GitHub app, but could not determine how these tokens were obtained or whether Fly.io’s infrastructure had been breached.
This campaign has left many organizations vulnerable, and experts warn that if the malware executed, all accessible secrets should be assumed compromised. To mitigate this risk, it is essential for developers to revoke compromised tokens, rotate exposed secrets, and monitor for unauthorized cloud changes. Moreover, organizations should adopt robust access control measures and ensure that their GitHub repositories are regularly audited for potential security threats.
The similarities between the “wfx-loot” campaign and October’s “GhostAction” operation have led Aikido Security to speculate that two different actors may be involved. However, this distinction does not diminish the significance of the current threat, which serves as a stark reminder of the importance of prioritizing cybersecurity in software development.
The fact that an attacker has successfully compromised over 60,000 GitHub repositories underscores the need for developers and organizations to remain vigilant against credential theft campaigns. By staying informed about emerging threats and adopting proactive security measures, the development community can minimize its exposure to such attacks and ensure the integrity of their projects.
Source: SecurityWeek — 2026-11-12