Hackers Compromise 4,837 GitHub Accounts in 'wfx-loot' Campaign to Steal Cloud Credentials — Detection and Remediation Guide

---
title: GitHub Malicious Pull Request - Secrets Stealing
description: Detects suspicious GitHub pull request activity associated with secrets-stealing malware.
references:
  - https://www.bleepingcomputer.com/news/security/hackers-compromise-4-800-github-accounts-to-steal-cloud-credentials/
author: Security Arsenal
date: 2026/04/06
logsource:
  product: github
  service: audit
detection:
  selection:
    action: 'pull_request.opened'
    pull_request.title|contains:
      - 'update'
      - 'fix'
      - 'security'
      - 'patch'
    pull_request.body|contains:
      - 'curl'
      - 'wget'
      - 'http://'
      - 'https://'
  condition: selection
falsepositives:
  - Legitimate pull requests with external links
level: high
---
title: GitHub Repository Probing - Mass Scanning
description: Detects mass scanning of GitHub repositories, indicative of the wfx-loot campaign.
references:
  - https://www.bleepingcomputer.com/news/security/hackers-compromise-4-800-github-accounts-to-steal-cloud-credentials/
author: Security Arsenal
date: 2026/04/06
logsource:
  product: github
  service: audit
detection:
  selection:
    action: 'repo.access'
    actor: '*'
  timeframe: 5m
  condition: selection | count() > 50
falsepositives:
  - Legitimate automated scanning
level: medium
---
title: GitHub Secrets Exfiltration - Suspicious Command Execution
description: Detects execution of commands commonly used to steal secrets in compromised repositories.
references:
  - https://www.bleepingcomputer.com/news/security/hackers-compromise-4-800-github-accounts-to-steal-cloud-credentials/
author: Security Arsenal
date: 2026/04/06
logsource:
  product: github
  service: audit
detection:
  selection:
    action: 'repo.clone'
    command_line|contains:
      - 'curl'
      - 'wget'
      - 'base64'
      - 'eval'
      - 'exec'
  condition: selection
falsepositives:
  - Legitimate CI/CD pipelines
level: high

GitHubAuditEvent
| where Action == "pull_request.opened"
| where Title contains "update" or Title contains "fix" or Title contains "security" or Title contains "patch"
| where Body contains "curl" or Body contains "wget" or Body contains "http://" or Body contains "https://"
| summarize count() by Actor, Repository, Title
| where count_ > 5
| order by count_ desc

GitHubAuditEvent
| where Action == "repo.access"
| summarize count() by Actor, Repository
| where count_ > 50
| order by count_ desc

GitHubAuditEvent
| where Action == "repo.clone"
| where CommandLine contains "curl" or CommandLine contains "wget" or CommandLine contains "base64" or CommandLine contains "eval" or CommandLine contains "exec"
| summarize count() by Actor, Repository, CommandLine
| where count_ > 1
| order by count_ desc

-- Hunt for suspicious processes matching threat indicators
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ 'curl|wget|base64|eval|exec'
   OR Exe =~ 'github|git'

-- Hunt for suspicious files in GitHub repositories
SELECT FullPath, Size, Mtime
FROM glob(glob='C:\Users\*\Documents\GitHub\**\*.ps1')
WHERE Size > 1024

-- Hunt for network connections to suspicious domains
SELECT Pid, Name, RemoteAddress, RemotePort, State
FROM netstat()
WHERE RemoteAddress =~ 'github.com|raw.githubusercontent.com'

# GitHub Security Hardening Script
# Run this script on all GitHub organization accounts

# 1. Rotate all GitHub tokens
$tokens = Get-GitHubToken -All
foreach ($token in $tokens) {
    Revoke-GitHubToken -Token $token.Id
    New-GitHubToken -Description "Rotated after wfx-loot campaign"
}

# 2. Enable two-factor authentication (2FA) for all users
$users = Get-GitHubUser -All
foreach ($user in $users) {
    if (-not $user.TwoFactorEnabled) {
        Enable-GitHub2FA -User $user.Login
    }
}

# 3. Audit recent pull requests for suspicious activity
$pullRequests = Get-GitHubPullRequest -All -State Open
foreach ($pr in $pullRequests) {
    if ($pr.Body -match 'curl|wget|http://|https://') {
        Write-Warning "Suspicious PR detected: $($pr.Title) - $($pr.Url)"
        # Optionally close or review the PR
    }
}

# 4. Enforce branch protection rules
$repos = Get-GitHubRepository -All
foreach ($repo in $repos) {
    Set-GitHubBranchProtection -Repository $repo.Name -Branch main -RequirePullRequestReviews -RequireStatusChecks
}

# 5. Scan for exposed secrets in repositories
$repos | ForEach-Object {
    $secrets = Get-GitHubSecret -Repository $_.Name
    if ($secrets) {
        Write-Warning "Exposed secrets found in $($_.Name)"
        # Rotate or revoke exposed secrets
    }
}

Write-Output "GitHub security hardening complete. Review warnings and take appropriate action."