GitHub Accounts Compromised in WFX-Loot Campaign, Exposing CI/CD and Cloud Credentials

Security researchers from Aikido have uncovered a widespread campaign, named "wfx-loot," that has resulted in the compromise of 4,837 GitHub accounts. The attackers leveraged these compromised accounts to scan and target 61,764 code repositories, successfully stealing secrets stored in GitHub Actions and credentials used to access cloud environments. This campaign began on November 10, 2026, with attackers creating pull requests to test write permissions on compromised accounts. Once a writable repository was identified, malicious scripts were injected through GitHub Actions workflows or npm installation steps. These scripts were designed to steal tokens, cloud credentials for AWS, Azure, and Google Cloud, developer infrastructure credentials for services like Docker, Kubernetes, and Terraform, and API keys for AI services including OpenAI, Anthropic, Gemini, and GitHub Copilot. At least 1,835 repositories have already had secrets stolen. This incident is highly significant for several reasons. Firstly, it underscores the growing sophistication of software supply chain attacks. By compromising developer accounts and injecting malicious code directly into CI/CD pipelines, attackers can gain deep access to an organization's infrastructure and intellectual property. The fact that some compromised accounts belonged to Fortune 100 companies, government organizations, and major open-source projects like Nextcloud and WebdriverIO, demonstrates the broad impact and potential for cascading compromises. Furthermore, approximately 50 of the compromised accounts had permissions to publish packages to major software ecosystems, including npm, PyPI, and Go, presenting a severe risk of widespread malicious package distribution. This attack fits into a broader, well-established trend of increasing focus by threat actors on the software supply chain. The automation inherent in CI/CD, while boosting efficiency, also presents a tempting target for adversaries. Previous incidents have shown that compromising build systems or third-party dependencies can lead to widespread impact, as seen with the increasing number of malicious packages discovered in public repositories. The integration of AI services into development workflows further expands the attack surface, as evidenced by the theft of API keys for various AI platforms in this campaign. The speed at which threat actors can now automate the full intrusion lifecycle, often shrinking exploitation windows to mere hours with AI assistance, makes proactive security measures more critical than ever. In practice, this means practitioners must urgently re-evaluate their CI/CD security posture. This includes implementing stringent access controls and multi-factor authentication for all GitHub accounts and other development tools. Regular auditing of GitHub Actions workflows and npm installation steps for suspicious activity is crucial. Organizations should also consider implementing secret scanning tools that can detect exposed credentials within code repositories and CI/CD logs. Furthermore, the use of ephemeral credentials and least-privilege access principles for all automated processes within the pipeline can significantly limit the blast radius of such attacks. Finally, staying informed about emerging threats and actively participating in security communities to share intelligence will be vital in defending against these evolving supply chain risks.