A large-scale cyberattack on the GitHub platform has compromised tens of thousands of software projects, including those linked to major US corporations and government bodies in the US and France. According to researchers at Aikido Security, the attackers used 4,837 compromised accounts to send fraudulent pull requests to 61,764 repositories. In at least 1,835 cases, the company estimates, malicious code was executed and transmitted confidential data to the hackers. The main aim of the attack was to steal passwords, digital keys and access to cloud services.<\/p>\n
The campaign, which the researchers dubbed \u2018wfx-loot\u2019, began on 10 November 2026. The attackers used stolen developers\u2019 credentials to gain access to repositories \u2014 storage sites for software code on GitHub<\/strong>.<\/p>\n Initially, requests for changes were sent on behalf of compromised users with the subject line The hackers then injected a malicious script into GitHub Actions\u2019 automated workflows. The code ran whilst work tasks were being carried out and collected confidential information.<\/p>\n A distinctive feature of the attack was the cover-up of their tracks. After stealing the data, the attackers reversed the changes they had made and deleted the execution logs, sometimes within a minute.<\/p>\n According to the researchers, the compromised accounts had access to the repositories of major Fortune 100 companies, the US General Services Administration (GSA), the French government platform beta.gouv.fr, and the open-source projects Nextcloud and WebdriverIO.<\/p>\n However, the fact that these repositories are accessible does not mean that data has been stolen from each of the organisations mentioned.<\/p>\n The malware targeted access keys for Amazon Web Services, Microsoft Azure, Google Cloud<\/a>, as well as tokens GitHub<\/a>, SSH keys and API keys for artificial intelligence services, including OpenAI and Anthropic.<\/p>\n In some cases, the code attempted to create additional mechanisms for accessing the cloud infrastructure, which could remain active even after the stolen passwords had been changed.<\/p>\n According to preliminary estimates by Aikido Security, the malicious code was executed in at least 1,835 repositories. However, another section of the study provides a more conservative estimate of 1,806 projects. The actual number of affected projects may be higher due to the deletion of logs.<\/p>\n The campaign also affected software package distribution ecosystems, notably Packagist and Go.<\/p>\n Experts recommend that developers check the change history, GitHub Actions logs and all connected services. If malicious code has been executed in the repository, you must replace any potentially compromised keys and check whether the attackers have left any hidden access points to the cloud infrastructure.<\/p>","protected":false},"excerpt":{"rendered":" \u041c\u0430\u0441\u0448\u0442\u0430\u0431\u043d\u0430 \u043a\u0456\u0431\u0435\u0440\u0430\u0442\u0430\u043a\u0430 \u043d\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0443 GitHub \u043f\u043e\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u043f\u0456\u0434 \u0437\u0430\u0433\u0440\u043e\u0437\u0443 \u0434\u0435\u0441\u044f\u0442\u043a\u0438 \u0442\u0438\u0441\u044f\u0447 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043d\u0438\u0445 \u043f\u0440\u043e\u0454\u043a\u0442\u0456\u0432, \u0437\u043e\u043a\u0440\u0435\u043c\u0430 \u043f\u043e\u0432\u2019\u044f\u0437\u0430\u043d\u0438\u0445 \u0456\u0437 \u0432\u0435\u043b\u0438\u043a\u0438\u043c\u0438 \u0430\u043c\u0435\u0440\u0438\u043a\u0430\u043d\u0441\u044c\u043a\u0438\u043c\u0438 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0446\u0456\u044f\u043c\u0438 \u0442\u0430 \u0434\u0435\u0440\u0436\u0430\u0432\u043d\u0438\u043c\u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0430\u043c\u0438 \u0421\u0428\u0410 \u0456 \u0424\u0440\u0430\u043d\u0446\u0456\u0457. \u0417\u0430 \u0434\u0430\u043d\u0438\u043c\u0438 \u0434\u043e\u0441\u043b\u0456\u0434\u043d\u0438\u043a\u0456\u0432 Aikido Security, \u0437\u043b\u043e\u0432\u043c\u0438\u0441\u043d\u0438\u043a\u0438 \u0432\u0438\u043a\u043e\u0440\u0438\u0441\u0442\u0430\u043b\u0438 4837 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u043e\u0432\u0430\u043d\u0438\u0445 \u0430\u043a\u0430\u0443\u043d\u0442\u0456\u0432, \u0449\u043e\u0431 \u043d\u0430\u0434\u0456\u0441\u043b\u0430\u0442\u0438 \u043f\u0456\u0434\u0440\u043e\u0431\u043b\u0435\u043d\u0456 \u0437\u0430\u043f\u0438\u0442\u0438 \u043d\u0430 \u0437\u043c\u0456\u043d\u0438 \u0434\u043e 61 764 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0456\u0457\u0432. \u0429\u043e\u043d\u0430\u0439\u043c\u0435\u043d\u0448\u0435 \u0443 1835 \u0432\u0438\u043f\u0430\u0434\u043a\u0430\u0445, \u0437\u0430 \u043e\u0446\u0456\u043d\u043a\u043e\u044e \u043a\u043e\u043c\u043f\u0430\u043d\u0456\u0457, \u0448\u043a\u0456\u0434\u043b\u0438\u0432\u0438\u0439 \u043a\u043e\u0434 \u0432\u0438\u043a\u043e\u043d\u0430\u0432\u0441\u044f \u0442\u0430 [\u2026]<\/p>\n","protected":false},"author":207433346,"featured_media":37085,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rank_math_description":"\u0425\u0430\u043a\u0435\u0440\u0438 \u0432\u0438\u043a\u043e\u0440\u0438\u0441\u0442\u0430\u043b\u0438 4837 \u0437\u043b\u0430\u043c\u0430\u043d\u0438\u0445 \u0430\u043a\u0430\u0443\u043d\u0442\u0456\u0432 GitHub \u0434\u043b\u044f \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u043f\u043e\u043d\u0430\u0434 61 \u0442\u0438\u0441\u044f\u0447\u0443 \u043f\u0440\u043e\u0454\u043a\u0442\u0456\u0432. \u0423 \u0449\u043e\u043d\u0430\u0439\u043c\u0435\u043d\u0448\u0435 1835 \u0432\u0438\u043f\u0430\u0434\u043a\u0430\u0445 \u0432\u0438\u043a\u0440\u0430\u043b\u0438 \u043a\u043e\u043d\u0444\u0456\u0434\u0435\u043d\u0446\u0456\u0439\u043d\u0456 \u0434\u0430\u043d\u0456.","rank_math_title":"\u0425\u0430\u043a\u0435\u0440\u0438 \u0437\u043b\u0430\u043c\u0430\u043b\u0438 5000 \u0430\u043a\u0430\u0443\u043d\u0442\u0456\u0432 GitHub \u0456 \u0430\u0442\u0430\u043a\u0443\u0432\u0430\u043b\u0438 60 \u0442\u0438\u0441\u044f\u0447 \u043f\u0440\u043e\u0454\u043a\u0442\u0456\u0432","rank_math_focus_keyword":"GitHub","td_subtitle":"","subtitle":"","footnotes":""},"categories":[805620],"tags":[806764],"class_list":["post-37084","post","type-post","status-publish","format-standard","has-post-thumbnail","category-science-tech","tag-806764"],"_links":{"self":[{"href":"https:\/\/ukrmedia.news\/en\/wp-json\/wp\/v2\/posts\/37084","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ukrmedia.news\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ukrmedia.news\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ukrmedia.news\/en\/wp-json\/wp\/v2\/users\/207433346"}],"replies":[{"embeddable":true,"href":"https:\/\/ukrmedia.news\/en\/wp-json\/wp\/v2\/comments?post=37084"}],"version-history":[{"count":2,"href":"https:\/\/ukrmedia.news\/en\/wp-json\/wp\/v2\/posts\/37084\/revisions"}],"predecessor-version":[{"id":37087,"href":"https:\/\/ukrmedia.news\/en\/wp-json\/wp\/v2\/posts\/37084\/revisions\/37087"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ukrmedia.news\/en\/wp-json\/wp\/v2\/media\/37085"}],"wp:attachment":[{"href":"https:\/\/ukrmedia.news\/en\/wp-json\/wp\/v2\/media?parent=37084"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ukrmedia.news\/en\/wp-json\/wp\/v2\/categories?post=37084"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ukrmedia.news\/en\/wp-json\/wp\/v2\/tags?post=37084"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}docs: dependency audit notes<\/code>. They appeared to be routine technical updates, but in fact helped to verify which projects the attackers had write access to.<\/p>\nThe projects targeted included government bodies in the US and France<\/h2>\n
Researchers warn of the risk of new attacks due to stolen keys<\/h2>\n