Attacker Used 4,837 Hijacked GitHub Accounts to Run a CI Secret Stealer in 1,806+ Repositories

# Attacker Used 4,837 Hijacked GitHub Accounts to Run a CI Secret Stealer in 1,806+ Repositories

https://gcdradar.vercel.app/incidents/attacker-used-4-837-hijacked-github-accounts-to-run-a-ci-sec · AIR-2026-1920 · live

- Lane: Supply chain
- Severity: 3 (Confirmed exploitation): Confirmed exploitation of CI secret stealer across 1,806 repositories
- Fix status: No fix needed
- First reported: 2026-11-12 (happened 2026-11-10)
- AI role: No AI role
- Products: GitHub

## Summary

An attacker compromised 4,837 GitHub accounts and injected a secret‑stealing tool into the CI pipelines of at least 1,806 repositories. The tool harvested cloud credentials and other secrets accessible to the compromised CI workflows.

## What to do

Revoke compromised credentials, rotate all secrets, and audit CI workflows for malicious code

## Latest updates

- 2026-11-12: Researchers name the campaign wfx-loot and confirm the malware ran in over 1800 repositories. (https://helpnetsecurity.com/2026/11/12/wfx-loot-github-actions-secret-stealer)
- 2026-11-12: Attacker Used 4,837 Hijacked GitHub Accounts to Run a CI Secret Stealer in 1,806+ Repositories (https://thehackernews.com/2026/11/4837-hijacked-github-accounts-ran-ci.html)

## Sources

- 2026-11-12 The Hacker News: Attacker Used 4,837 Hijacked GitHub Accounts to Run a CI Secret Stealer in 1,806+ Repositories https://thehackernews.com/2026/11/4837-hijacked-github-accounts-ran-ci.html
- 2026-11-12 Help Net Security: Check your GitHub repos: A secret stealer hit tens of thousands of them https://helpnetsecurity.com/2026/11/12/wfx-loot-github-actions-secret-stealer
- 2026-11-12 SecurityWeek: Attacker Targets 60,000 GitHub Repositories in Credential Theft Campaign https://securityweek.com/attacker-targets-60000-github-repositories-in-credential-theft-campaign
- 2026-11-12 BleepingComputer: Hackers compromise 4,800 GitHub accounts to steal cloud credentials https://bleepingcomputer.com/news/security/hackers-compromise-4-800-github-accounts-to-steal-cloud-credentials

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.