A large-scale cyberattack on the GitHub platform has compromised tens of thousands of software projects, including those linked to major US corporations and government bodies in the US and France. According to researchers at Aikido Security, the attackers used 4,837 compromised accounts to send fraudulent pull requests to 61,764 repositories. In at least 1,835 cases, the company estimates, malicious code was executed and transmitted confidential data to the hackers. The main aim of the attack was to steal passwords, digital keys and access to cloud services.
Briefly about the main points
The hackers used 4,837 compromised GitHub accounts.
More than 61,000 software projects received fraudulent change requests.
Malicious code has been detected in at least 1,835 repositories.
Corporate passwords, API keys and access to cloud platforms have been compromised.
How hackers gained access to thousands of GitHub projects
The campaign, which the researchers dubbed ‘wfx-loot’, began on 10 November 2026. The attackers used stolen developers’ credentials to gain access to repositories — storage sites for software code on GitHub.
Initially, requests for changes were sent on behalf of compromised users with the subject line docs: dependency audit notes. They appeared to be routine technical updates, but in fact helped to verify which projects the attackers had write access to.
The hackers then injected a malicious script into GitHub Actions’ automated workflows. The code ran whilst work tasks were being carried out and collected confidential information.
A distinctive feature of the attack was the cover-up of their tracks. After stealing the data, the attackers reversed the changes they had made and deleted the execution logs, sometimes within a minute.
The projects targeted included government bodies in the US and France
According to the researchers, the compromised accounts had access to the repositories of major Fortune 100 companies, the US General Services Administration (GSA), the French government platform beta.gouv.fr, and the open-source projects Nextcloud and WebdriverIO.
However, the fact that these repositories are accessible does not mean that data has been stolen from each of the organisations mentioned.
The malware targeted access keys for Amazon Web Services, Microsoft Azure, Google Cloud, as well as tokens GitHub, SSH keys and API keys for artificial intelligence services, including OpenAI and Anthropic.
In some cases, the code attempted to create additional mechanisms for accessing the cloud infrastructure, which could remain active even after the stolen passwords had been changed.
Researchers warn of the risk of new attacks due to stolen keys
According to preliminary estimates by Aikido Security, the malicious code was executed in at least 1,835 repositories. However, another section of the study provides a more conservative estimate of 1,806 projects. The actual number of affected projects may be higher due to the deletion of logs.
The campaign also affected software package distribution ecosystems, notably Packagist and Go.
Experts recommend that developers check the change history, GitHub Actions logs and all connected services. If malicious code has been executed in the repository, you must replace any potentially compromised keys and check whether the attackers have left any hidden access points to the cloud infrastructure.
Click Here For The Original Source.
——————————————————–
