What it is
The wfx-loot campaign is exploiting compromised GitHub accounts and CI workflows to harvest API keys and cloud credentials from software repositories.
Overview
Security analysts reported that attackers used 4,837 compromised user accounts to infiltrate GitHub continuous-integration pipelines starting Nov 10. A credential-harvesting payload called wfx-loot was planted in 61,764 repositories and reportedly executed in at least 1,800 of them. The malware targets OIDC and GitHub Actions secrets, cloud credentials and API keys while using persistence techniques that may survive rotation.
How it could play out
Why it matters
The campaign matters for software teams, AI-service users, cloud providers and security responders because stolen CI secrets can enable downstream compromise.
Key details
• Aikido earlier reported successful execution in at least 1,835 repositories. • The campaign used 4,837 compromised user accounts. • Targeted secrets included OpenAI and Anthropic API keys. • AWS, Azure and Google Cloud credentials were also targeted. • The stealer can modify AWS trust policies and add Azure federated credentials.
Tilt can alert you when its scenarios shift, or send you a recommendation when one crosses a threshold.
Stories in this saga
Portfolio
Portfolio
How it could play out
Saga, how it could play out
Sagawfx-loot GitHub Actions credential-theft campaign
GitHub and affected repository owners identify the malware pattern quickly, revoke malicious access paths, and remove most tainted repositories before broad downstream use. The event remains a serious developer-platform incident but does not become a market-moving software supply-chain crisis.
Investigators find that the repository campaign is not only stealing credentials but also attempting to seed malicious updates into software packages and CI/CD workflows. The event becomes a broader open-source supply-chain issue affecting enterprise security teams over the next several days.
GitHub, package registries, and enterprise customers respond with stricter repository controls rather than waiting for more forensic findings. The main outcome is a tightening of developer security practices, including mandatory secret scanning, provenance checks, and shorter token lifetimes.
Security firms and government agencies connect the 61,000-repository campaign to earlier 2026 credential-theft activity targeting GitHub, LiteLLM, and exposed API keys. The main uncertainty is whether the actors are financially motivated criminals or a state-linked group conducting broader reconnaissance.
The saga on the S&P 500
Portfolio
Portfolio