Reports Detail CI Secret Stealer Campaign Using 4,837 Stolen GitHub Accounts
Summary
Aikido and SafeDep report that stolen GitHub credentials were used to plant a CI secret stealer in thousands of repositories. The stealer could collect workflow and cloud credentials; Aikido says credentials were likely collected where it ran.
Key points
- Aikido says credentials for 4,837 GitHub accounts were used to test access to 61,764 repositories; the stealer ran in at least 1,806.
- SafeDep counted malicious commits in 8,093 public repositories’ default branches, including repositories where the stealer did not run; the researchers say the total is higher.
- The attacker added the stealer to existing CI workflows or as an npm postinstall hook, and usually reverted changes soon afterward.
- The stealer could collect GitHub Actions secrets and tokens, cloud and AI-service credentials, credential files, repository history, and workflow artifacts. On self-hosted runners it could also access instance metadata and Docker state.
- It could exchange GitHub OIDC tokens for cloud sessions, create long-lived AWS keys, alter AWS role trust policies, and add Azure federated credentials that could preserve access after token rotation.
- Researchers found a malicious digitalelvis/neuronai-studio 3.14.3 package; they advise blocking it and pinning 3.14.2 or earlier. A normal Composer install does not run the stealer, but npm install in the package’s vendor directory does.
- SafeDep recommends revoking tokens, app grants, SSH keys, and sessions, enabling 2FA, and rotating accessible secrets. Aikido says it has not attributed this campaign to the actor behind October’s GhostAction wave.
Article Details
- Attack Vectors
- The attacker used stolen credentials for GitHub accounts to test repository write access with pull requests titled "docs: dependency audit notes" from branches named "wfx-docs," then pushed malicious workflow changes to some repositories.
- The stealer was added to existing GitHub Actions workflows or delivered as an npm postinstall hook, which can run during npm install.
- The stealer collected CI secrets, cloud credentials, tokens, credential files, repository history, and workflow artifacts; on self-hosted runners it also accessed instance metadata, Docker container state, and systemd units.
- It exchanged GitHub OIDC tokens for AWS, GCP, and Azure sessions, created long-lived AWS access keys, modified AWS role trust policies, and added federated identity credentials to Azure AD applications.
- The stealer sent collected data by HTTP POST or to a Telegram chat. In a sample of 200 payload commits, about one-fifth used Telegram only.
- Malicious versions of digitalelvis/neuronai-studio and workflow-file changes in two Go modules were identified; the article also reports the stealer in a workflow in github.com/vkuznet/gocurl.
- Defensive Notes
- For affected repositories, revoke the commit author's tokens, OAuth app grants, SSH keys, and sessions, and enable 2FA.
- Rotate every secret and variable accessible to an affected repository. Anyone who ran npm install on an affected commit should treat that machine as compromised and rotate its keys.
- Check repositories for wfx-loot artifacts, wfx- cache entries, WFX-BEGIN step summaries, and missing run numbers on attacker commits; the article says a missing run number is the more reliable sign that the stealer ran.
- Block digitalelvis/neuronai-studio version 3.14.3 and pin version 3.14.2 or earlier. Remove or block github.com/onuragtas/docker-env versions v1.0.278 and v1.0.280, and block github.com/vkuznet/gocurl pseudo-version v0.0.0-20261111095532-8d5aad0cb0da.
- Check AWS role trust policies for changes that allow any AWS account and Azure AD applications for added federated identity credentials with the prefix wfx-ci-.
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelThe stealer exfiltrated collected data by HTTP POST to addresses or to a Telegram chat.T1078 · Valid AccountsThe attacker used stolen credentials for GitHub accounts to test write access and push malicious commits.T1098.001 · Additional Cloud CredentialsThe stealer could create long-lived AWS access keys for IAM users and add federated identity credentials to Azure AD applications.T1098.003 · Additional Cloud RolesThe stealer could rewrite an AWS role's trust policy to allow access from any AWS account.T1195.002 · Compromise Software Supply ChainMalicious repository changes included a stealer in workflows and a malicious Packagist package version; the article also reports affected Go modules.T1528 · Steal Application Access TokenThe stealer collected GitHub Actions, OIDC, and Actions runtime tokens available to the workflow.T1550.001 · Application Access TokenThe stealer exchanged GitHub OIDC tokens for AWS, GCP, and Azure sessions.T1552.001 · Credentials In FilesThe stealer read credential files from the runner, including files for AWS, Azure, GCP, Kubernetes, npm, PyPI, and SSH.T1552.004 · Private KeysThe stealer collected SSH keys from credential sources on the runner.T1552.005 · Cloud Instance Metadata APIOn self-hosted runners, the stealer obtained cloud credentials from instance metadata.T1565.001 · Stored Data ManipulationThe attacker added or modified repository workflow files to run the secret stealer.
Products
Azure ADIt can also add federated identity credentials with the prefix wfx-ci- to Azure AD applications. Workflows in the compromised repository can then sign in to Azure without a stored secret, even after all tokens aredigitalelvis/neuronai-studioVersion 3.14.3 of the Packagist package digitalelvis/neuronai-studio is malicious, and the company advises treating any machine that installed or opened it as compromised. Its package listing shows the version wasGitHubStarting Tuesday, an attacker used stolen credentials for 4,837 GitHub accounts to plant a secret stealer in repositories those accounts could write to, according to Aikido Security, a security software company.GitHub Actionsbuilt to collect credentials from every source on the runner, according to the company. They include GitHub Actions secrets and variables, the workflow's GITHUB_TOKEN, OIDC and Actions runtime tokens, keys for AIgithub.com/onuragtas/docker-envTwo versions of the Go module github.com/onuragtas/docker-env, v1.0.278 and v1.0.280, carry the stealer only in a GitHub Actions workflow file. The Go code and release binaries are unchanged, and Go builds never rungithub.com/vkuznet/gocurlThe researchers also found the stealer in another Go module, github.com/vkuznet/gocurl, in pseudo-version v0.0.0-20261111095532-8d5aad0cb0da, inside a workflow that has never run. Users should block that pseudo-version.npmIn 7,309 of those repositories, the stealer was added to an existing workflow. In 771, it came as an npm postinstall hook, which also runs on a developer's machine during npm install.