Adobe
Attacker Targets 60,000 GitHub Repositories in Credential Theft Campaign
At a glance
Low rather than Medium: UK relevance is 40 of 100, little UK-specific signal so far.
Briefing
- Organisations should verify if their GitHub repositories are affected by this credential theft campaign.
Next steps
Monitor- For awareness — no fixed action deadline for this reporting
No technical write-up beyond the summary below yet.
Next steps
Monitor- No immediate technical action — track if your estate depends on the products or vendors discussed
Summary
- An attacker used hijacked accounts to plant a CI secret stealer in over 1,800 GitHub repositories as part of the wfx-loot campaign.
- The campaign targeted 60,000 GitHub repositories through the deployment of a credential theft tool.
Products and services involved
- Adobe Campaign94% match confidence
Part of Credential theft campaigns targeting cloud and code repositories
Pulse
Last change 1h ago · Next recheck 13 Nov 2026, 14:28 UK time
- Story12 Nov 2026, 14:28 UK time · 1h ago
Linked reporting from SecurityWeek (independent original reporting).
Read source (SecurityWeek)
1 entry so far. The timeline chart appears once this story has more history.
Sources
- SecurityWeekNews
Attacker Targets 60,000 GitHub Repositories in Credential Theft Campaign
How we know
Statements extracted from sources. Higher confidence means stronger corroboration.
- ClaimedHeadline60% confidence
Attacker Targets 60,000 GitHub Repositories in Credential Theft Campaign
- ProbableSummary fact75% confidence
Using thousands of hijacked accounts, the wfx-loot campaign planted a CI secret stealer that ran in over 1,800 GitHub repositories. The post Attacker Targets 60,000 GitHub Repositories in Credential Theft Campaign appeared first on SecurityWeek.