Hackers compromise 4,800 GitHub accounts to steal cloud credentials
Teaser from the source
A new campaign dubbed 'wfx-loot' has unfolded on GitHub where threat actors used 4,837 compromised accounts to probe 61,764 repositories, open pull requests, and push secrets-stealing malware. [...]
This is the RSS-feed teaser. Read the full article at the original source.
Read at BleepingComputerMore on GitHub
Other advisories
- Not ratedosv:RHSA-2026:99063Red Hat Security Advisory: golang-github-openprinting-ipp-usb security update
- Not ratedosv:RHSA-2026:98108Red Hat Security Advisory: golang-github-openprinting-ipp-usb security update
- Not ratedosv:RHSA-2026:88280Red Hat Security Advisory: golang-github-openprinting-ipp-usb security update
- Not ratedosv:ROOT-APP-GOBINARY-CVE-2026-63209CVE-2026-63209 in github.com/klauspost/compress - Patched by Root
- Not ratedosv:ROOT-APP-GOBINARY-CVE-2026-116591CVE-2026-116591 in github.com/klauspost/compress - Patched by Root
- Not ratedosv:USN-9069-1golang-github-seccomp-libseccomp-golang vulnerability
- Not ratedosv:CVE-2026-65820aeon: Privileged GitHub Actions workflow allowed fork-controlled code execution
- HighCVE-2026-65820aeon is a scikit-learn compatible Python library for learning from time series. Prior to version 1.5.0, a GitHub Actions workflow used pull_request_target fo…
Other news entries
- Thousands of GitHub repos hit with secret-stealing malwareNewsCSO Online
- Gestohlene Token: Secret-Stealer in Tausenden GitHub-RepositoriesNewsheise Security
- Attacker Targets 60,000 GitHub Repositories in Credential Theft CampaignNewsSecurityWeek
- Attacker Used 4,837 Hijacked GitHub Accounts to Run a CI Secret Stealer in 1,806+ RepositoriesNewsThe Hacker News
- AI Coding Agents Leak Thousands of Secrets to GitHubNewsDark Reading
- Binance Warns of iOS Sandbox Escape That Could Expose Crypto Wallet Keys, No Fix ConfirmedNewsThe Hacker News
- Claude Code is accidentally exposing secrets all over GitHubNewsArs Technica — Security
- Tensorlake: attacker reached engineering GitHub via vendor-hosted sandboxes after unrotated env varsBreachpwn.watch
ID