Daily Cyber Threat Brief — November 13, 2026: GitHub 'wfx-loot' campaign steals cloud secrets from 1,800+ targets

Incident timeline

Date	Development
November 9–10, 2026	Unauthorized access to parts of Apify's internal systems; the Czech web-scraping platform detects the intrusion on November 11 at 12:13 UTC and begins rotating customer API tokens and proxy passwords.
November 10, 2026, ~12:45 UTC	The "wfx-loot" campaign begins: 4,837 compromised GitHub accounts start probing 61,764 repositories for write access.
November 10, 2026	N-able ships Hotfix 2 (build 2026.4.1.26) for the Able2Shell N-central zero-days disclosed days earlier.
November 11, 2026	Apache releases HTTP Server 2.4.71, fixing critical mod_http2 remote code execution flaw CVE-2026-119618. Huntress discovers the active ScreenConnect campaign against MSPs (first activity around 17:47 UTC) — the campaign SCKit was built for.
November 12, 2026, 03:58 UTC	Security researcher Sean Bales publishes proof-of-concept exploits for two new N-central flaws, "4EverAble2Shell" and "Agent2Shell", tested against the November 10 Hotfix 2 build.
November 12, 2026, 08:30–12:50 UTC	Attackers probe N-central honeypots from 08:30 UTC; the first full exploit chain runs at 09:16 UTC; by 12:50 UTC Huntback counts 21 live N-central servers mining Monero for the attacker's wallet.
November 12, 2026	Europol announces the latest Operation Endgame action against Gootloader, CastleRAT, and StealC (actions ran November 9–11). BleepingComputer reports the wfx-loot campaign, the SCKit toolkit, and the Apache patch. Microsoft investigates a worldwide Microsoft 365 outage affecting Outlook, Teams, and Copilot.

1. GitHub "wfx-loot" campaign steals cloud secrets from 1,800+ targets

Tens of thousands of GitHub repositories were targeted in a campaign dubbed "wfx-loot" that uses malicious workflows to steal GitHub Actions secrets and cloud credentials. Application security company Aikido, which uncovered the campaign, says it began around 12:45 UTC on November 10, when the attacker used stolen credentials from 4,837 compromised GitHub accounts to probe 61,764 repositories for write access. The threat actor opened pull requests titled "docs: dependency audit notes", disguised as dependency audit notes, and 92% of them remain open — suggesting the legitimate repository owners did not notice the activity.

Where the probe found write access, the attacker delivered a 1,500-line credential-stealing shell script by modifying an existing GitHub Actions workflow, adding a new workflow on a short-lived branch, or planting an npm install hook. The script collected GitHub Actions secrets and variables, the workflow's GITHUB_TOKEN, OIDC tokens, and Actions runtime tokens; cloud credentials for AWS, Azure, and Google Cloud, including credentials exposed through instance metadata on self-hosted runners; developer and infrastructure credentials from Git, SSH, GPG, Docker, Kubernetes, npm, PyPI, Vault, and Terraform; and AI service credentials for OpenAI, Anthropic, Gemini, Hugging Face, Cursor, and GitHub Copilot. It also swept environment variables, .env files, private keys, keystores, shell histories, process memory, repository files, recent commits, and workflow artifacts. The collected data was compressed into tarballs and exfiltrated via HTTP POST to one of two attacker-controlled endpoints, after which the attacker reverted the changes and deleted workflow runs and logs — all in under a minute.

The script goes further than theft: it can exchange GitHub OIDC tokens for temporary AWS, Azure, and GCP sessions, chain into additional IAM roles in AWS to create long-lived credentials, impersonate identities in GCP, and establish persistent access by modifying cloud identity and trust policies where permissions allow. Aikido confirmed secrets were stolen from at least 1,835 targets. About 50 of the compromised accounts appear to have publishing rights on other open-source ecosystems and package indexes such as npm, PyPI, Go, crates, and Packagist — and automated publishing carried the payload into three releases: Packagist's digitalelvis/neuronai-studio 3.14.3 and two versions of the Go module github.com/onuragtas/docker-env. Aikido says the primary objective was stealing CI secrets and the package releases were a byproduct of automated publishing, and notes overlaps with the 2025 GhostAction campaign.

Investigation notes

Why this is the lead: this is a supply-chain credential harvest at platform scale — 61,764 repositories probed, secrets confirmed stolen from at least 1,835 targets, and the haul includes live cloud credentials and AI service keys that unlock infrastructure beyond GitHub itself. The 92% of probe pull requests still open means most affected owners have not yet looked.

What is confirmed: 4,837 compromised accounts, 61,764 repositories probed, secrets stolen from at least 1,835 targets (Aikido, via BleepingComputer, November 12); the script's collection scope and exfiltration method; the three poisoned package releases; the overlap with the 2025 GhostAction campaign.

What is not known: the threat actor behind the campaign, how the 4,837 GitHub credentials were originally obtained, and the full extent of downstream cloud compromise from the stolen credentials. Aikido's count of 1,835 targets is a confirmed floor — repositories where the payload ran — not a ceiling.

What repository owners should do: look for the "wfx-docs" branch, the probe pull request, and gaps in workflow run numbers. Where payload execution is confirmed, treat all secrets and cloud roles available to the affected workflows as compromised and rotate them immediately — including OIDC trust relationships, which the script was built to abuse.

2. New N-able "4EverAble2Shell" zero-day exploited hours after PoC released

Hackers are actively exploiting a newly disclosed N-able N-central zero-day vulnerability dubbed "4EverAble2Shell" to compromise servers and deploy cryptocurrency miners, with researchers reporting at least 21 affected systems — including 19 running the company's latest security update. Security researcher Sean Bales published proof-of-concept exploits for two new flaws on November 12, just two days after N-able released emergency security updates for critical N-central zero-days Bales had disclosed earlier in the week. Bales says he published rather than disclosing privately because of the vendor's slow patching, and says two unrelated remote code execution flaws he reported to N-able in July remain unfixed.

The 4EverAble2Shell chain starts with an Apache Axis vulnerability, CVE-2026-90436 (CVSS 9.8), to execute commands as the "nable" service account, then exploits a separate N-central privilege escalation flaw to obtain root. The second exploit, Agent2Shell, targets N-central's agent functionality and is claimed to allow command execution with SYSTEM privileges on managed Windows devices. Exploitation of 4EverAble2Shell requires the platform's Legacy API functionality to be enabled — it is off by default and not recommended, but exposed on the affected servers.

The speed from publication to exploitation was measured in hours. Bales published the exploits at 03:58 UTC on November 12. Cybersecurity company Previdian saw probing of its N-central honeypot at about 08:30 UTC using the same Java class referenced in the public exploit, and full exploit attempts after that. Huntback saw the same attacker IP begin running the full chain at 09:16 UTC, downloading a shell script that installed the XMRig Monero miner. Using the attacker's mining pool statistics, Huntback counted 21 live N-central servers mining at 12:50 UTC — 19 of them on build 2026.4.1.26, the Hotfix 2 build N-able released on November 10 — spread across the US, Canada, the UK, Germany, France, Sweden, and South Africa. N-able's status page says it has seen no signs of compromise via the new flaws, while it restricts some N-central features and integrations and works on further fixes.

Investigation notes

Official anchor, and its limits: the exploitation is confirmed by two independent researchers — Previdian's honeypot telemetry and Huntback's mining-pool count — but the chain is not yet in CISA's Known Exploited Vulnerabilities catalog, which remains at version 2026.11.10, and no CVE has been assigned to the N-central privilege escalation itself; Previdian tracks it as VULN-2026-0009. The Apache Axis link, CVE-2026-90436, carries a CVSS score of 9.8.

The uncomfortable fact: 19 of the 21 mining servers were on the November 10 Hotfix 2 build. Patching to the latest release did not protect them, because the new flaws are different from the ones Hotfix 2 addressed. The mitigation for now is configuration, not a patch: keep the Legacy API disabled, and treat any N-central server with it exposed to the internet as a priority check.

What is confirmed: active exploitation within hours of the public PoC; 21 production servers mining Monero, 19 on Hotfix 2 (Huntback, November 12); the attacker IP 157.20.241.16 and the XMRig payload; the Legacy API precondition.

What is not known: the full count of compromised servers — 21 is the number mining for one wallet at one pool in one five-minute window, a floor, not a total — and whether the miners are the whole story or a placeholder while the attacker keeps root access for later use. The exposure surface is wide: Shodan currently shows about 11,900 exposed N-central instances across 54 countries, every one a potential target while no patch exists for the new flaws.

3. Worm-like "SCKit" toolkit found in the ScreenConnect attacks on MSPs

A new worm-like malware toolkit named SCKit was deployed in the ScreenConnect attacks targeting managed service providers, designed to spread from infected customer devices to MSP technicians' computers and compromise additional managed networks. The toolkit was documented on November 12 by BleepingComputer, based on analyses by Huntress and Blackpoint Cyber, and follows the active ScreenConnect campaign discovered on November 11 — which Huntress now counts at 288 compromised endpoints across 48 organizations, all targeted within 90 minutes.

SCKit is a collection of 16 scripts and components built to establish persistent remote access and spread between systems managed through ScreenConnect. One component, RelayTrap, replaces the legitimate ScreenConnect Guest process on an infected endpoint and waits for an MSP technician to establish an interactive connection. The toolkit then attempts to exploit CVE-2026-84869, a critical ScreenConnect client-side file-transfer vulnerability that ConnectWise patched in version 26.6.5, to execute malicious code on the technician's workstation. Blackpoint Cyber's Adversary Pursuit Group recovered the loader directly from attacker-controlled infrastructure and decrypted the subsequent stages.

The worm-like spread, however, has not been observed working. Huntress and Blackpoint Cyber say they have seen no successful exploitation of CVE-2026-84869 during the attacks, and Blackpoint reproduced the toolkit's attempted exploit against a current ScreenConnect client and found the existing security fix prevented execution. The confirmed damage remains the original campaign: attackers using compromised cloud-hosted ScreenConnect environments and the platform's Run Command feature to install rogue ScreenConnect remote-access clients on customer endpoints. ConnectWise has disabled five third-party ScreenConnect extensions across approximately 400 partner environments as a precaution, and the initial access method is still unconfirmed — Huntress's telemetry points to compromised credentials and hijacked MSP support sessions.

Investigation notes

Evidence rule, applied: SCKit is built to spread like a worm, and that is confirmed — but the spread itself is not. Both research teams state plainly that they have no evidence of successful exploitation of CVE-2026-84869 and no evidence of a bypass. Report the capability as designed, the exploitation as attempted and unproven, and the confirmed victim count as 288 endpoints across 48 organizations from the underlying campaign.

What is confirmed: SCKit's 16 components and the RelayTrap mechanism (Huntress, Blackpoint Cyber); 288 endpoints across 48 organizations hit within 90 minutes (Huntress, updated November 12); the CVE-2026-84869 patch in ScreenConnect 26.6.5 blocking the attempt in Blackpoint's reproduction.

What is not known: how the attackers first gained access to the MSP ScreenConnect environments, and whether any technician workstation was compromised through the attempted spread.

What MSPs should do: confirm ScreenConnect clients are on 26.6.5 or later, avoid interactive sessions with suspected compromised devices, review account activity, revoke active sessions, and reset credentials from a trusted device — ConnectWise's standing advice for this campaign.

4. Apache HTTP Server patches critical HTTP/2 remote code execution flaw

A critical vulnerability in the HTTP/2 module of Apache HTTP Server could be exploited by an unauthenticated attacker to obtain remote code execution. The Apache Software Foundation fixed the issue, now tracked as CVE-2026-119618, in version 2.4.71, released November 11 — but a significant number of servers are vulnerable and reachable over the public internet. The flaw is a race condition in the mod_http2 module's assign_headers() function that can corrupt heap memory; an attacker who exploits it successfully could run code with the web server process's privileges on HTTP Server versions 2.4.55 through 2.4.70, and standalone mod_h2 versions 2.0.8 through 2.0.42.

The vulnerability was discovered independently by two teams: Anthropic's OSS Scanner reported it on October 26, and Google Cloud's Vulnerability Research team reported it on November 3. Researchers at watchTowr confirmed the condition. Wiz, which assesses the severity as critical, reports that 64 percent of the cloud environments it observes contain resources vulnerable to CVE-2026-119618, and 51 percent have publicly exposed instances. Version 2.4.71 also fixes CVE-2026-106023, a null pointer dereference in mod_md, and CVE-2026-109163, a low-severity data overwrite flaw in mod_vhost_alias.

Investigation notes

Official anchor: the Apache Software Foundation's advisory and the 2.4.71 release of November 11. The flaw is classified CWE-362 (concurrent execution using shared resource with improper synchronization). Only servers with HTTP/2 enabled via the Protocols directive are exposed; a server speaking HTTP/1.1 only is not vulnerable, which is also the interim mitigation — disable the http2 module until the upgrade lands.

Exploitation status: no in-the-wild exploitation has been reported, and no public exploit was available at publication time according to Wiz. But Red Hat notes that published research has demonstrated reliable exploitation against a default-configured server with mod_http2 enabled, so the exploit barrier should be treated as low. The flaw is not in CISA's KEV catalog.

Why this matters at this scale: Apache HTTP Server backs roughly one in five websites, and Wiz's telemetry puts vulnerable resources in nearly two-thirds of the cloud environments it watches. Distro patches were not out as of November 12 — Debian and Ubuntu users should check their package status rather than assuming the upstream release has reached them.

5. Police dismantle Gootloader, CastleRAT, and StealC infrastructure in Operation Endgame

Europol and law enforcement partners from nine countries have seized hundreds of servers and domains used by the Gootloader, CastleRAT, and StealC malware operations, in the latest action under Operation Endgame, announced November 12. Together with private partners, the authorities seized 257 domains and 235 servers, and identified 6.4 million victim datasets on the targeted criminal infrastructure — stolen from malware-infected systems for use in other cyberattacks, including ransomware breaches. The participating countries were Bulgaria, Canada, Denmark, Germany, Moldova, the Netherlands, Poland, the United Kingdom, and the United States, with Europol and Eurojust coordinating.

Gootloader, a malware loader active since 2020, drew victims through fake legal documents hosted on compromised websites, frequently hacked WordPress installations; authorities took down 14 servers and 218 domains and remediated 681 infected websites. CastleRAT, a remote access trojan known since 2025, gives attackers remote control over compromised computers; authorities seized 120 servers and 39 domains and shared victim information for notifications. StealC, an infostealer with dropper functionality that collects passwords, stored credentials, and digital identities, lost 102 servers — extending disruption efforts against it that began in June 2026. No arrests were reported in the coverage of this action: treat it as a disruption and seizure, not a permanent end to these operations.

Investigation notes

A discrepancy worth stating: the per-family server counts — 14 for Gootloader, 120 for CastleRAT, 102 for StealC — add to 236, one more than Europol's headline total of 235. Europol has not explained the difference. The domain figures match the stated total of 257. Use the headline totals, and note the one-server gap rather than smoothing it over.

What the numbers mean: the 6.4 million figure counts victim datasets or credentials recovered from the seized infrastructure, not necessarily 6.4 million distinct individuals. And seizing infrastructure does not clean an already infected machine or un-steal a password — organizations that find these families in their environment still need to rotate the credentials the malware harvested.

The pattern: this is the third Operation Endgame action this year against the cybercrime-as-a-service economy — the June phase also hit StealC — and the model is the same each time: take the tools and infrastructure that other criminals rent, and the ransomware and data-theft operations downstream lose a supplier.

Sources

• Hackers compromise 4,800 GitHub accounts to steal cloud credentials — BleepingComputer
• New N-able "4EverAble2Shell" zero-day exploited hours after PoC released — BleepingComputer
• New worm-like 'SCKit' malware targets MSPs in ScreenConnect attacks — BleepingComputer
• Apache HTTP Server patches critical HTTP/2 remote code execution flaw — BleepingComputer
• Police dismantle Gootloader, CastleRAT, StealC malware infrastructure — BleepingComputer