---
title: "Discussion on \"wfx-loot: GitHub Actions Secret Stealer in 1,806 Repos\" | Hashnode"
description: "Discussion on \"wfx-loot: GitHub Actions Secret Stealer in 1,806 Repos\". Since 2026-11-10, an attacker has used stolen credentials for 4,837 GitHub accounts to push a credential stealer into repositories those accounts can write to. Aikido Security named the campaign wfx-l"
url: "https://hashnode.com/posts/rapid-wfx-loot-github-actions-secret-stealer-in-1-806-repos/6af61f707a52329c2b5e59dd"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [wfx-loot: GitHub Actions Secret Stealer in 1,806 Repos](https://404-founders.com/blog/rapid-wfx-loot-github-actions-secret-stealer-in-1-806-repos?utm_source=hashnode&utm_medium=feed)

Since 2026-11-10, an attacker has used stolen credentials for 4,837 GitHub accounts to push a credential stealer into repositories those accounts can write to. Aikido Security named the campaign wfx-l

15h ago · 4 min read · 404-founders.com  
Read the article

-   [#cybersecurity](https://hashnode.com/tag/cybersecurity)
-   [#vulnerability](https://hashnode.com/tag/vulnerability)

## Written by

[404 Founders](https://hashnode.com/@404-founders)

@404-founders · Bosnia and Herzegovina, Estonia

  
[View profile](https://hashnode.com/@404-founders)

Error-proof Cyber Solutions

Securing the digital frontier. Error-proof cyber solutions.

## Responses

Markdown supported · ⌘↵ to post

No responses yet.