GoKawiilAttack on 4,837 GitHub accounts steals secrets from over 1,800 repositories
Researchers at Aikido identified a campaign dubbed 'wfx-loot' that used nearly 4,837 compromised GitHub accounts to open pull requests against more than 61,000 repositories, checking for write access. Where successful, attackers inserted a 1,500-line script into GitHub Actions workflows or npm install hooks to harvest cloud credentials, tokens and developer secrets, confirming theft from at least 1,835 targets, including accounts tied to Fortune 100 firms, US and French government bodies, Nextcloud and WebdriverIO.