A major cybersecurity campaign targeting GitHub highlights a growing enterprise security concern: the credentials used by developers and automated software deployment systems can provide attackers with access far beyond the source code repository itself.

Security researchers have identified a campaign called wfx-loot, in which attackers used more than 4,800 compromised GitHub accounts to target over 61,000 repositories.

The attackers injected malicious code into automated software development workflows, allowing them to steal credentials associated with AWS, Microsoft Azure, Google Cloud, Kubernetes, developer tools and AI services.

Researchers confirmed credential theft from at least 1,835 targets.

What makes this attack particularly concerning is that the attackers did not need to exploit a vulnerability in the cloud platforms themselves. They used legitimate credentials and trusted development workflows to gain access to sensitive information.

The malicious code was also designed to obtain additional cloud privileges and establish persistent access. After stealing credentials, the attackers quickly reversed their modifications and deleted workflow logs, making the activity more difficult to detect.

For enterprises, this raises an important question: Are organisations securing their software development environments with the same seriousness as their production infrastructure?

Modern applications rely on interconnected development platforms, cloud services, APIs and automated deployment pipelines. A single compromised developer account or automation token can potentially expose credentials that provide access to multiple business-critical systems.

This incident reinforces the importance of Zero Trust access, least-privilege permissions, secure secrets management, continuous behavioural monitoring and strict controls over automated workflows.

Organisations must monitor unusual repository modifications, unexpected workflow execution, excessive credential access and suspicious cloud activity originating from trusted service identities.

Equally important is ensuring that stolen credentials cannot be used indefinitely. Credential rotation, short-lived tokens, restricted cloud permissions and monitoring for unauthorised changes to cloud trust policies are essential safeguards.

The cybersecurity lesson is that a trusted developer account or automated workflow should never be treated as automatically safe.

Because attackers no longer need to find a vulnerability in every system they want to compromise. Sometimes, stealing the credentials that connect those systems is enough.

A new campaign dubbed 'wfx-loot' has unfolded on GitHub where threat actors used 4,837 compromised accounts to probe 61,764 repositories, open pull requests, and push secrets-stealing malware. [...]

Source: Hackers compromise 4,800 GitHub accounts to steal cloud credentials via Bleeping Computer — published 12 Nov 2026.