Attacker Targets 60,000 GitHub Repositories in Credential Theft Campaign

Aikido Security reported the operation, named wfx-loot, identified approximately 4,800 compromised accounts behind probe pull requests submitted to 61,764 repositories. The requests tested whether stolen access allowed changes to repositories before malware deployment.

Aikido found evidence that the stealer ran in more than 1,800 repositories, while SafeDep counted 8,093 public repositories receiving malicious commits. The attacker placed malware in GitHub Actions workflows, shell scripts, and npm installation hooks.