Attackers using stolen GitHub credentials run a CI-based “secret stealer” campaign that targets tens of thousands of repositories. Multiple outlets say the malware is deployed through repository workflows the attacker can access, with the payload designed to collect secrets and cloud credentials available to continuous integration (CI) and then send them to the attacker.
Reporting cites Aikido Security’s investigation of the incident. SecurityWeek and Help Net Security describe the campaign as “wfx-loot,” referring to the attacker’s own labeling of the malware and what it steals. The Hacker News also points to the same attribution and reports the scale of compromise, including the number of hijacked accounts and the approximate number of repositories where the stealer executed.
While the outlets largely align on the campaign name, method, and overall scope, they vary slightly in the specific counts they highlight and the emphasis on how many repositories were affected versus how many were merely targeted.
