GoKawiilAttack on 4,837 GitHub accounts steals secrets from over 1,800 repositories
Researchers at Aikido identified a campaign dubbed 'wfx-loot' that used nearly 4,837 compromised GitHub accounts to open pull requests against more than 61,000 repositories, checking for write access. Where successful, attackers inserted a 1,500-line script into GitHub Actions workflows or npm install hooks to harvest cloud credentials, tokens and developer secrets, confirming theft from at least 1,835 targets, including accounts tied to Fortune 100 firms, US and French government bodies, Nextcloud and WebdriverIO.
GoKawiil's interpretation of the reporting above, not reported fact.
The campaign's use of disguised pull requests titled as routine 'dependency audit notes' suggests attackers aimed to evade manual review, and Aikido notes 92% of these requests remain open, indicating many maintainers never spotted them. Because roughly 50 compromised accounts reportedly have publishing rights on ecosystems like npm, PyPI and Go, the breach could enable follow-on supply-chain attacks affecting software far beyond the initially compromised repositories.
- 4,837 compromised GitHub accounts were used to probe over 61,000 repositories for write access.
- At least 1,835 repositories had secrets stolen via a credential-harvesting script hidden in workflows or npm hooks.
- About 50 affected accounts hold publishing rights on major package registries, raising supply-chain risk concerns.
Yubico YubiKey 5C NFC — With GitHub credential theft campaigns like this compromising thousands of accounts, hardware-based two-factor authentication is one of the strongest defenses available to developers. A YubiKey lets you secure GitHub, npm, and other publishing accounts with phishing-resistant authentication that stolen passwords alone can't bypass. It's a small investment that can prevent your repos and secrets from becoming the next statistic in a supply-chain attack.
See Yubico YubiKey 5C NFC on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-11-12
Published there as: “Hackers compromise 4,800 GitHub accounts to steal cloud credentials”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.