# SZB-b1fc427f51: Aikido Security reports attacker used 4,837 hijacked GitHub accounts to plant CI secret stealer

Aikido Security says an attacker used stolen credentials for 4,837 GitHub accounts to add a secret stealer to repositories those accounts could write to, reaching at least 1,806 repositories.

- Type: Breach
- Status: Corroborated
- Vendor: GitHub
- Product: GitHub
- Disclosed: 2026-11-12 06:42 UTC
- Data taken: 1.8K records: Tokens and keys
- Way in: Stolen credentials (BleepingComputer: “Aikido says the wfx-loot campaign began around 12:45 UTC on November 10, when the attacker used stolen GitHub credentials from 4,837 compromised accounts to pr…”, [source](https://www.bleepingcomputer.com/news/security/hackers-compromise-4-800-github-accounts-to-steal-cloud-credentials/))
- Campaign: wfx-loot (BleepingComputer: “A new campaign dubbed 'wfx-loot' has unfolded on GitHub where threat actors used 4,837 compromised accounts to probe 61,764 repositories, open pull requests, a…”, [source](https://www.bleepingcomputer.com/news/security/hackers-compromise-4-800-github-accounts-to-steal-cloud-credentials/))
- Sources: 4 distinct
- First seen by cve.now: 2026-11-12 07:28 UTC · Updated: 2026-11-12 22:35 UTC

> No statement or filing from GitHub has reached cve.now yet. Every claim below is quoted from, and linked to, the source that made it.

Written by a model from the sources below. Verify against them.

## Summary

SafeDep counted 8,093 repositories that received malicious commits, and the researchers say the true total is higher.

## What to do

- Rotate API keys and tokens you gave it, and review the OAuth apps and integrations connected to it · For tokens and keys
- Revoke the commit author's tokens, OAuth app grants, SSH keys, and sessions, and turn on 2FA.
- Rotate every secret and variable the affected repository can read, and treat every secret and cloud role available to its workflows as compromised.
- Check repositories you can write to for the wfx-docs branch, ci-check-\[0-9\]{4} branches, and the 'docs: dependency audit notes' pull request title.
- Treat any machine that ran npm install on an affected commit as compromised and rotate its keys.
- Revoke any GitHub tokens that may have been compromised, including tokens tied to developer and bot accounts.
- Rotate repository secrets, cloud credentials and AI service keys that were accessible in affected workflows.

## Timeline

- 2026-11-12 06:42 UTC: Made public by The Hacker News
- 2026-11-12 07:28 UTC: First seen by cve.now

## What was taken

1.8K records, per [Catalin Cimpanu on Bluesky](https://www.aikido.dev/blog/compromised-github-accounts-push-ci-secret-stealer-to-tens-of-thousands-of-repositories).

- Tokens and keys: [Catalin Cimpanu on Bluesky](https://www.aikido.dev/blog/compromised-github-accounts-push-ci-secret-stealer-to-tens-of-thousands-of-repositories): “At least 1,835 repositories ran the payload and have had credentials exfiltrated.”

## Evidence (4 sources)

- 2026-11-12 · Press · [The Hacker News](https://thehackernews.com/2026/11/4837-hijacked-github-accounts-ran-ci.html): “Starting Tuesday, an attacker used stolen credentials for 4,837 GitHub accounts to plant a secret stealer in repositories those accounts could write to, according to Aikido Security, a security software company.”
- 2026-11-12 · Press · [SecurityWeek](https://www.securityweek.com/attacker-targets-60000-github-repositories-in-credential-theft-campaign/): “An attacker has tested stolen access to more than 60,000 GitHub repositories and inserted credential-stealing code in thousands of them, several security firms report.”
- 2026-11-12 · Press · [Catalin Cimpanu on Bluesky](https://bsky.app/profile/campuscodi.risky.biz/post/3n24mqkin4c2b): “A threat actor is pushing malicious workloads to GitHub repositories that steal secrets and cloud credentials from GitHub Actions”
- 2026-11-12 · Press · [BleepingComputer](https://www.bleepingcomputer.com/news/security/hackers-compromise-4-800-github-accounts-to-steal-cloud-credentials/): “A new campaign dubbed 'wfx-loot' has unfolded on GitHub where threat actors used 4,837 compromised accounts to probe 61,764 repositories, open pull requests, and push secrets-stealing malware.” (+1 more: [BleepingComputer on Bluesky](https://bsky.app/profile/bleepingcomputer.com/post/3n25j7mzb7n24))

## Corrections

- 2026-11-12: Changed “4,837 people or records were affected” to “1,835 people or records were affected”.

Something wrong on this page? Report an error: https://github.com/sazabi/cve.now/issues/new?title=Wrong%20fact%20on%20SZB-b1fc427f51&body=https%3A%2F%2Fcve.now%2FSZB-b1fc427f51%0A%0AWhat%20is%20wrong%2C%20and%20the%20source%20that%20shows%20it%3A%0A

## Questions about the GitHub breach

### Was GitHub breached?

The Hacker News reports it. No statement from GitHub has reached cve.now yet.

### What data was exposed?

1.8K records. Tokens and keys.

### What should GitHub customers do?

Rotate API keys and tokens you gave it, and review the OAuth apps and integrations connected to it. Revoke the commit author's tokens, OAuth app grants, SSH keys, and sessions, and turn on 2FA. Rotate every secret and variable the affected repository can read, and treat every secret and cloud role available to its workflows as compromised. Check repositories you can write to for the wfx-docs branch, ci-check-[0-9]{4} branches, and the 'docs: dependency audit notes' pull request title. Treat any machine that ran npm install on an affected commit as compromised and rotate its keys. Revoke any GitHub tokens that may have been compromised, including tokens tied to developer and bot accounts. Rotate repository secrets, cloud credentials and AI service keys that were accessible in affected workflows.

## Related

- Started as early warning SZB-b1fc427f51, first seen 2026-11-12 07:28 UTC
- Early warning [SZB-fbb1a4c05c](https://cve.now/SZB-fbb1a4c05c.md)
- Browse: [Breaches](https://cve.now/breaches.md) · [Early warnings](https://cve.now/early-warnings.md)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/SZB-b1fc427f51
Site guide for agents: https://cve.now/llms.txt