Hijacked GitHub accounts planted a CI secret stealer in 1,806+ repos
Original title: Attacker Used 4,837 Hijacked GitHub Accounts to Run a CI Secret Stealer in 1,806+ Repositories
Stolen credentials for 4,837 accounts opened test pull requests in 61,764 repositories, Aikido Security says.
Starting Tuesday, an attacker used stolen credentials for 4,837 GitHub accounts to plant a secret stealer in repositories those accounts could write to, according to Aikido Security. The stealer ran in at least 1,806 repositories and is built to collect CI secrets, cloud credentials, and tokens, then keep access after rotation. SafeDep counted malicious commits in 8,093 public default-branch repositories. How the credentials were obtained is not explained.
Unconfirmed: Aikido and SafeDep report different repository counts, and the source of the stolen credentials is unknown.
- Test pull requests used the title "docs: dependency audit notes" and branch wfx-docs.
- In 771 repositories the payload arrived as an npm postinstall hook.
- The attacker often reverted changes within minutes and deleted workflow logs.
- About a fifth of a 200-commit sample exfiltrated through Telegram only.
- Persistence includes AWS trust-policy changes and Azure credentials named wfx-ci-*.
Impact: CI secrets, cloud credentials, and workflow tokens stolen
| Product | Affected |
|---|---|
| GitHub | — |
- 1.Revoke the commit author's tokens, OAuth grants, SSH keys, and sessions, and enable 2FA.
- 2.Rotate every secret and variable the affected repository can read.
- 3.Check Entra ID, AWS, GCP, and Vault for wfx-ci-* or wfx-* backdoors.
- ATT&CK
- T1078 Valid AccountsT1195.002 Compromise Software Supply ChainT1552 Unsecured CredentialsT1098 Account ManipulationT1567 Exfiltration Over Web Service
- Vendors
- GitHub
- Products
- npm
- Organizations
- Aikido SecuritySafeDep
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 153.75.82.159 | 150.166[.]244:8080/exfil IP: 18.143.168[.]96:8080/exfil IP: 153.75.82[.]159:8080 A repository can show no wfx-loot artifacts, wfx- ca |
| ipv4 | 18.143.168.96 | ed7173c2a2816c762735cf IP: 194.150.166[.]244:8080/exfil IP: 18.143.168[.]96:8080/exfil IP: 153.75.82[.]159:8080 A repository can show |
| ipv4 | 194.150.166.244 | 92d5cfd4972672961e644bb46baa98aa1ed7173c2a2816c762735cf IP: 194.150.166[.]244:8080/exfil IP: 18.143.168[.]96:8080/exfil IP: 153.75.82[. |
| sha256 | 89695abb392d5cfd4972672961e644bb46baa98aa1ed7173c2a2816c762735cf | store Commit message: ci: cleanup SHA-256 (stealer script): 89695abb392d5cfd4972672961e644bb46baa98aa1ed7173c2a2816c762735cf IP: 194.150.166[.]244:8080/exfil IP: 18.143.168[.]96:8080/e |
From the original article
6 min read at thehackernews.com
Starting Tuesday, an attacker used stolen credentials for 4,837 GitHub accounts to plant a secret stealer in repositories those accounts could write to, according to Aikido Security, a security software company. The stealer is built to take the secrets and cloud credentials that a repository's CI workflows can reach. It ran in at least 1,806 repositories, where the attacker has likely collected
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.