GitHub Credential Theft Campaign Impacts Thousands of Repositories

An attacker has exploited stolen credentials from 4,837 GitHub accounts to deploy a secret stealer in at least 1,806 repositories. The 'wfx-loot' campaign, which began on November 10, used probe pull requests to identify repositories where the stolen access permitted changes, subsequently inserting credential-stealing code into existing or new GitHub Actions workflows, shell scripts, and npm installation hooks. The malware targets GitHub tokens, repository secrets, cloud credentials, and AI service keys, with functionality to expand access and establish persistence in AWS and Azure.