Credential-Theft Campaign Probed 61,764 GitHub Repositories
Summary
Security firms say the wfx-loot campaign used stolen tokens to probe 61,764 GitHub repositories and insert credential-stealing code into thousands; Aikido found signs the stealer ran in more than 1,800 repositories.
Key points
- Aikido says the wfx-loot operation began November 10 and involved roughly 4,800 accounts behind probe pull requests to 61,764 repositories.
- The pull requests tested whether stolen tokens allowed repository changes; malware was deployed where permissions and configuration permitted.
- SafeDep counted 8,093 public repositories with malicious commits, which does not necessarily mean the code executed. Aikido found signs of execution in more than 1,800 repositories.
- Malicious code was placed in GitHub Actions workflows, CI shell scripts, and npm installation hooks; it sought GitHub tokens, repository secrets, cloud credentials, and AI service keys.
- The script also read GitHub Actions runner process memory and included functionality intended to expand access and establish persistence in AWS and Azure.
- StepSecurity traced 173 probe pull requests to tokens issued to the Fly.io GitHub app, but could not determine how the tokens were obtained and found no evidence Fly.io infrastructure was breached.
- Organizations were advised to revoke compromised tokens, rotate exposed secrets, check for unauthorized cloud changes, and assume accessible secrets were compromised if the malware executed.
Article Details
- Event Type
- Credential-theft campaign involving unauthorized changes to GitHub repositories and malicious code in software workflows and packages.
- Impact
- Aikido Security reported roughly 4,800 compromised accounts behind probe pull requests to 61,764 repositories, and signs that the stealer ran in more than 1,800 repositories. SafeDep separately counted 8,093 public repositories with malicious commits, which does not necessarily mean the code executed. The malware sought GitHub tokens, repository secrets, cloud credentials, and AI service keys, and had functionality to expand access and establish persistence in AWS and Azure. Aikido advised assuming accessible secrets were compromised if the malware ran.
Products
AWSIt also reads GitHub Actions runner process memory and has functionality designed to expand access and establish persistence in AWS and Azure.AzureIt also reads GitHub Actions runner process memory and has functionality designed to expand access and establish persistence in AWS and Azure.GitHubAn attacker has tested stolen access to more than 60,000 GitHub repositories and inserted credential-stealing code in thousands of them, several security firms report.GitHub Actions“The attacker does not exploit a bug in GitHub Actions,” StepSecurity noted.npmplaced the malware in existing or new GitHub Actions workflows, shell scripts run by CI systems, and npm installation hooks. The npm method also poses a risk to developers who install dependencies while the