Fake audit notes probed over 61,000 GitHub repositories for cloud secrets
Text
Aikido links wfx-loot to 4,837 compromised accounts and malicious automation that can disappear from ordinary code history.
An innocuous-looking audit request can precede a hunt for cloud credentials. Aikido's November 12 report links wfx-loot to 4,837 stolen accounts probing 61,764 GitHub repositories.
The target is CI: automated testing, packaging and deployment workflows that often hold powerful credentials. Researchers identified execution in at least 1,800 repositories. A probe alone does not establish secret theft.
Attackers quickly reverted changes and deleted workflow runs and logs, Aikido says. Clean-looking code therefore does not establish that credentials are safe. BleepingComputer also covered the investigation.
Developers should investigate unfamiliar audit requests, branches and missing workflow runs. Confirmed execution warrants credential rotation and review of cloud roles and unauthorized access. These findings concern abused account access, not proof of a platform-wide GitHub breach.
Source times: Aikido page updated November 13, 2026, 02:00:17 Beijing / November 12, 1:00:17 PM EST; BleepingComputer published November 13, 06:25:30 Beijing / November 12, 5:25:30 PM EST.
Share this article
What do you think of this story?
Anonymous feedback, up to 5 reactions per article.
Anonymous comments
Share your thoughts without signing in.
Discuss the technology and the story. Hate, politics and war, threats, abuse, personal accusations, sexual content, ads, links and personal information are not allowed.
No comments yet. Be the first to share.