CybersecurityUpdated Yesterday

Wfx-loot probed 61,764 GitHub repositories.

Wfx-loot turned compromised GitHub accounts into a route for planting malware in repositories. BleepingComputer reports that attackers used credentials for 4,837 accounts to probe 61,764 repositories, opening pull requests and pushing a stealer. Those are two different scopes: Aikido Security says the malware ran in at least 1,806 repositories. Its target was secrets and cloud credentials a repository’s CI workflows could access. The account access got the malware into projects; the CI workflows put valuable credentials within its reach.

2 publishers2 reports

Coverage started Yesterday