Hackers Hijack Thousands of GitHub Accounts to Steal Cloud Secrets

Scope of the wfx loot campaign

The security community has identified a coordinated effort that compromised 4,837 GitHub accounts. Threat actors used these accounts to probe 61,764 repositories, open pull requests, and push malware designed to extract cloud credentials. The operation, labeled wfx loot, represents one of the largest known instances of account takeover on the platform.

Scale of compromised accounts and repositories

Analysis of public GitHub activity shows that the attackers targeted a broad set of projects, ranging from small open source libraries to large enterprise‑backed code bases. The compromised accounts were used to create a network of fake contributors, allowing the malicious code to blend in with legitimate changes.

Attack methodology

Rather than exploiting a single vulnerability, the actors leveraged stolen personal access tokens and credentials obtained from previous data breaches. Once inside, they performed automated scans to locate files that commonly contain secrets, such as configuration files and environment variable definitions.

Credential harvesting techniques

Typical targets included AWS access keys, Azure service principal credentials, and Google Cloud service account JSON files. The malware was programmed to search for patterns that match known secret formats, copy the values, and exfiltrate them to a remote command and control server.

Use of pull requests to deliver malware

After identifying a vulnerable repository, the attackers opened a pull request that appeared to fix a minor issue. The change included a script that, when executed by a developer or CI pipeline, would download additional payloads and run the secret‑stealing routine. Because the pull request came from a previously trusted account, many maintainers merged it without extensive review.

Impact on cloud services

Stolen cloud credentials give attackers the ability to spin up resources, read data, and even delete services. In several reported cases, the exfiltrated keys were used to create unauthorized virtual machines, leading to unexpected billing spikes and potential data exposure.

Types of cloud credentials stolen

• AWS access key ID and secret access key
• Azure client ID, tenant ID and secret
• Google Cloud service account JSON keys
• DigitalOcean personal access tokens

Response from GitHub and the security community

GitHub issued an advisory acknowledging the activity and urged users to rotate all personal access tokens. The platform also introduced additional monitoring for anomalous pull request activity originating from newly compromised accounts. Security researchers have published detailed analyses of the malware, highlighting its modular design and the use of encrypted communication channels.

Mitigation steps recommended

Organizations are advised to adopt the following measures:

1. Enable multi‑factor authentication for all GitHub accounts.
2. Audit and rotate personal access tokens on a regular schedule.
3. Implement secret scanning tools that automatically flag exposed credentials in code.
4. Restrict CI pipelines from automatically executing code contributed by external contributors.
5. Monitor cloud accounts for unusual activity, such as sudden resource creation.

For further guidance, see the NIST Digital Identity Guidelines and the US‑CERT alert on supply chain threats.

Lessons for developers and organizations

The wfx loot campaign underscores the importance of treating every contribution as potentially hostile. Even accounts that have a history of legitimate activity can be compromised and used as vectors for attack.

Best practices for protecting secrets

Developers should store credentials outside of source code, using secret management services provided by cloud platforms. When secrets must be present in a repository, they should be encrypted and accessed at runtime through secure vaults.

Regular code reviews, especially for changes that modify build scripts or deployment pipelines, can catch malicious insertions before they reach production. Automated tools that flag high‑entropy strings or known secret patterns add an extra layer of defense.

Finally, organizations should maintain an incident response plan that includes steps for revoking compromised tokens, notifying affected stakeholders, and conducting forensic analysis of affected repositories.

As the software supply chain becomes an increasingly attractive target, vigilance at every stage—from developer workstation to cloud environment—remains the most effective safeguard.