Hackers compromise 4,800 GitHub accounts in wfx-loot campaign

Tier S · Shit hits the fan – Drop everything

Who’s exposed: Compromised GitHub accounts and the repositories they could access

Tier S because: Core infrastructure AND exploited in the wild AND (full takeover OR secrets exposed)

Reach

Attack

Damage

Fix

Core infrastructure · Popular tool · Exploited in the wild · Full takeover · Secrets exposed · Supply chain

The Brief

A campaign named 'wfx-loot' used 4,837 compromised GitHub accounts.
The attackers probed 61,764 repositories and opened pull requests.
The campaign pushed malware designed to steal secrets and cloud credentials.

Why it matters

If your GitHub account or repositories were part of this campaign, cloud credentials and other secrets stored there may have been exposed to attackers.

The checklist behind the tier

Checklist · 7 of 10 yes

Yes	Hits tech teams	Judgment: GitHub is a developer platform used by engineering teams worldwide.
Yes	Core infrastructure	Judgment: GitHub is listed as core infrastructure nearly every team uses.
Yes	Popular tool	Judgment: GitHub is a mainstream developer platform; coreInfra is yes.
Yes	Exploited in the wild	BleepingComputer: threat actors used 4,837 compromised accounts in the wfx-loot campaign.
No	Public exploit	BleepingComputer reports no published exploit code or proof-of-concept.
No	Remote, no login	BleepingComputer reports compromised accounts; it does not say attacks needed no credentials.
Yes	Full takeover	BleepingComputer: 4,800 GitHub accounts compromised, which is full account takeover.
Yes	Secrets exposed	BleepingComputer: hackers compromise GitHub accounts to steal cloud credentials.
Yes	Supply chain	BleepingComputer: attackers used compromised accounts to push secrets-stealing malware into repositories.
No	No fix yet	BleepingComputer does not state whether a fix or patch exists.

Timeline

Nov 12
Campaign reported by BleepingComputer
Nov 12 · 10:25 PM
BleepingComputer
Hackers compromise 4,800 GitHub accounts to steal cloud credentials

Source

Hackers compromise 4,800 GitHub accounts to steal cloud credentials ↗ BleepingComputer · 1h ago

First seen 1h ago · 1 source · Full story page · How tiers are decided