Hijacked GitHub accounts used to run data-stealing code in 1,806 repositories
In the wfx-loot attack observed since November 10, 4,837 hijacked GitHub accounts were used to scan 61,764 repositories. The attackers ran credential-stealing code in at least 1,806 repositories, collecting keys for cloud, development and AI services through GitHub Actions, npm installation scripts and other means. The initial account compromise vector for the overall campaign has not been established.
Key facts
- Affected organization
- GitHub
- Incident type
- Malware
- Occurred / detected
- 2026-11-10
- Scale of damage
- 4,837 accounts abused, 61,764 repositories scanned, and data-stealing code executed in at least 1,806 repositories
- Cause / method
- Hijacked developer accounts used to insert credential-stealing code into GitHub Actions, npm installation scripts and other components
- Location
- Other countries
Timeline
- The wfx-loot attack abusing hijacked GitHub accounts began to be observed.
- Endor Labs published a report detailing the abuse of 4,837 accounts and the execution of data-stealing code in at least 1,806 repositories.
7 related reports
- Hijacked GitHub Accounts Used to Plant CI Secret Stealer in Over 1,800 Repositories
- Attacker Targets 60,000 GitHub Repositories in Credential Theft Campaign
- wfx-loot Campaign Injects Credential Stealers into GitHub CI Workflows
- GitHub cyberattack hits thousands of repositories with stealer code
- Thousands Of GitHub Accounts Hijacked With wfx-loot CI Secret Stealing Malware Via GitHub Actions & npm
- Hackers compromise 4,800 GitHub accounts to steal cloud credentials
- 탈취한 깃허브 계정으로 6만여 저장소 탐색…최소 1,806곳서 자격증명 탈취
Other incidents at GitHub
Malicious extension infection leads to theft of 3,800 GitHub internal repositories
Impact: Data from 3,800 internal repositories
GitHub confirmed that data from 3,800 internal repositories was stolen in a breach carried out through a malicious Visual Studio Code extension. The infection occurred through an internal employee's device, and GitHub said customer data was not affected. TeamPCP, which claimed the attack, later took bids for the stolen data.
Related reports: 15 · last report →GitHub Copilot Chat flaw leaks private repository data
Impact: Private repository data
A flaw in GitHub Copilot Chat leaked data from private repositories. The scale of the leak, the date it occurred and specific response measures have not been confirmed.
Read on SecurityWeek ↗
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organization’s official statements for accurate details.