wfx-loot campaign steals CI and cloud secrets via GitHub
Aikido says secrets were taken from at least 1,835 targets after probes of 61,764 repositories.
78
Malware
wfx-loot
- Mentions · 7d3
- Mentions · 30d3
- All mentions3
- First seenNov 12, 2026
- Last mentioned11h ago
Timeline
3 articles · newest firstAttacker plants credential-stealing code across GitHub repositories
Stolen developer and bot tokens, not a GitHub Actions bug, were used to probe 61,764 repositories from November 10.
76
wfx-loot stole GitHub Actions secrets from thousands of repositories
Aikido says 4,837 accounts probed 61,764 repositories and the payload ran in more than 1,800 of them.
80
Appears with
- GitHubvendor · 3
- GitHub Actionsproduct · 3
- Aikidoorganization · 2
- WebdriverIOvictim · 1
- Fly.iovendor · 1
- Nextcloudvictim · 1
- neuronai-studioproduct · 1
- SafeDeporganization · 1
- npmproduct · 1
- US General Services Administrationvictim · 1
- Aikido Securityorganization · 1
- GhostActionmalware · 1
- StepSecurityorganization · 1
- docker-envproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.