Mass GitHub Credential Theft Campaign Hits 60,000 Repositories

Overview of the wfx-loot Campaign

The cybersecurity community has identified a large‑scale operation known as wfx-loot. Threat actors behind the campaign have hijacked thousands of user accounts and leveraged them to gain write access to a massive number of open‑source projects hosted on GitHub. By inserting malicious code into continuous integration (CI) workflows, the attackers created a pipeline that automatically exfiltrates secrets such as API keys, tokens, and passwords.

Scale of the Attack

Security researchers estimate that the operation targeted roughly 60,000 public repositories. Within that pool, more than 1,800 projects were observed to contain the active CI secret stealer. The malicious payload was distributed through compromised accounts that already possessed commit privileges, allowing the code to blend in with legitimate project history.

How the CI Secret Stealer Operates

Continuous integration platforms run automated scripts whenever code is pushed or a pull request is opened. The wfx-loot stealer inserts itself into these scripts, scans the environment for variables that hold sensitive data, and sends the findings to a remote command‑and‑control server.

Technical Steps

1. Compromise of a developer or bot account with write access.
2. Insertion of a malicious step into the CI configuration file (for example .github/workflows).
3. Execution of the step during the build process, where the script reads environment variables such as GITHUB_TOKEN or cloud provider keys.
4. Packaging of the harvested credentials and transmission over HTTPS to an attacker‑controlled endpoint.
5. Optional cleanup of the malicious commit to evade detection.

The technique mirrors tactics described in the MITRE ATT&CK credential dumping matrix, but adapts it to the software supply chain context.

Why GitHub Is a Prime Target

GitHub hosts millions of repositories that form the backbone of modern software development. Many projects rely on automated pipelines that automatically expose secrets to the build environment. When a compromised account can modify a workflow file, the attacker gains a reliable channel to harvest credentials across a wide range of downstream services.

The open nature of many repositories also means that a single compromised secret can be reused by multiple downstream applications, amplifying the impact of the theft.

Impact on Developers and Organizations

• Unauthorized access to cloud resources, leading to potential data breaches or ransomware deployment.
• Financial loss from the misuse of API quotas or paid services.
• Reputation damage when a supply chain breach becomes public.
• Increased workload for security teams tasked with rotating credentials and auditing commit histories.

Mitigation Strategies

Defending against this type of supply chain intrusion requires a layered approach. Below are recommended actions for developers, repository owners, and security teams.

• Enforce least‑privilege access. Limit the scope of personal access tokens and bot accounts to only the permissions required for their tasks.
• Adopt secret scanning tools. GitHub provides native secret scanning that alerts owners when credentials are committed. Enable this feature across all repositories.
• Implement signed commits. Require GPG‑signed commits for critical branches to verify the authenticity of changes.
• Rotate credentials regularly. Use automated rotation for cloud keys and API tokens to reduce the window of exposure.
• Monitor CI logs for anomalies. Look for unexpected network calls or environment variable accesses during builds.
• Apply supply chain security standards. Follow guidance from the NIST software supply chain security framework to establish best practices.

Organizations should also consider integrating third‑party security solutions that specialize in detecting malicious CI configurations. Early detection can prevent the exfiltration of credentials before they are used in larger attacks.

Response from the Security Community

When the campaign was first reported, the SecurityWeek article highlighted the need for immediate remediation. GitHub responded by updating its security policies and urging developers to audit recent commits for suspicious changes.

US‑CERT also issued an alert recommending that federal agencies review their open‑source usage and enforce multi‑factor authentication for all GitHub accounts.

By combining proactive credential management with continuous monitoring of CI pipelines, the risk posed by campaigns like wfx-loot can be substantially reduced.