NewsBleepingComputer
Hackers compromise 4,800 GitHub accounts to steal cloud credentials
Teaser from the source
A new campaign dubbed 'wfx-loot' has unfolded on GitHub where threat actors used 4,837 compromised accounts to probe 61,764 repositories, open pull requests, and push secrets-stealing malware. [...]
This is the RSS-feed teaser. Read the full article at the original source.
Read at BleepingComputerMore on GitHub
Other advisories
- Not ratedosv:CVE-2026-65820aeon: Privileged GitHub Actions workflow allowed fork-controlled code execution
- HighCVE-2026-65820aeon is a scikit-learn compatible Python library for learning from time series. Prior to version 1.5.0, a GitHub Actions workflow used pull_request_target fo…
- HighCVE-2026-111943Red Hat Security Advisory: golang-github-openprinting-ipp-usb security update
- Not ratedosv:ROOT-APP-GOBINARY-CVE-2026-116591CVE-2026-116591 in github.com/klauspost/compress - Patched by Root
- Not ratedosv:ROOT-APP-GOBINARY-CVE-2026-63209CVE-2026-63209 in github.com/klauspost/compress - Patched by Root
- Not ratedosv:ROOT-APP-GOBINARY-GHSA-9969-6676-49h5GHSA-9969-6676-49h5 in github.com/labstack/echo/v4 - Patched by Root
- Not ratedosv:ROOT-APP-GOBINARY-GHSA-h7wr-284f-5qvcGHSA-h7wr-284f-5qvc in github.com/labstack/echo/v4 - Patched by Root
- Not ratedosv:ROOT-APP-GOBINARY-GHSA-f48p-c9v4-h7xvGHSA-f48p-c9v4-h7xv in github.com/labstack/echo/v4 - Patched by Root
Other news entries
- Attacker Targets 60,000 GitHub Repositories in Credential Theft CampaignNewsSecurityWeek
- Attacker Used 4,837 Hijacked GitHub Accounts to Run a CI Secret Stealer in 1,806+ RepositoriesNewsThe Hacker News
- AI Coding Agents Leak Thousands of Secrets to GitHubNewsDark Reading
- Binance Warns of iOS Sandbox Escape That Could Expose Crypto Wallet Keys, No Fix ConfirmedNewsThe Hacker News
- Claude Code is accidentally exposing secrets all over GitHubNewsArs Technica — Security
- Tensorlake: attacker reached engineering GitHub via vendor-hosted sandboxes after unrotated env varsBreachpwn.watch
- Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHubNewsThe Hacker News
- Agents reveal secrets when offered to team up with each otherNewsThe Register — Security
ID