wfx-loot stole GitHub Actions secrets from thousands of repositories
Original title: Check your GitHub repos: A secret stealer hit tens of thousands of them
Aikido says 4,837 accounts probed 61,764 repositories and the payload ran in more than 1,800 of them.
Aikido says a threat actor using stolen GitHub credentials has pushed the wfx-loot credential stealer into tens of thousands of repositories since November 10. In more than 1,800 repositories the malware ran and sent GitHub Actions secrets and cloud credentials to the attacker. The actor opens a probe pull request, injects a roughly 1,500-line script, then reverts it and deletes the workflow run within a minute. Stolen material is used against AWS, GCP, and Azure, including durable trust changes that survive secret rotation.
Unconfirmed: Aikido assesses wfx-loot and GhostAction are likely different actors and says private-repository activity may be unseen.
- Of 61,764 probed repositories, 10,431 pull requests targeted repos the account did not own.
- Ninety-two percent of the probe pull requests were still open.
- The script creates long-lived AWS keys and Azure federated credentials that survive rotation.
- Listed packages include neuronai-studio 3.14.3 and docker-env v1.0.278 and v1.0.280.
- Accounts hit by October’s GhostAction campaign were significantly more likely to be hit.
Impact: GitHub Actions secrets and cloud and SSH credentials stolen
| Product | Affected |
|---|---|
| digitalelvis/neuronai-studio | 3.14.3 |
| github.com/onuragtas/docker-env | v1.0.278 and v1.0.280 |
- 1.Look for a wfx-docs branch, the probe pull request, or the named commit titles.
- 2.Treat reachable secrets, cloud roles, and machines that installed the Packagist package as compromised.
- 3.Remove attacker AWS trust-policy changes and Azure federated credentials; rotation alone is insufficient.
- ATT&CK
- T1078 Valid AccountsT1528 Steal Application Access TokenT1098.001 Additional Cloud CredentialsT1195.002 Compromise Software Supply Chain
- Vendors
- GitHub
- Products
- GitHub Actions
- Malware
- wfx-lootGhostAction
- Organizations
- Aikido
From the original article
2 min read at helpnetsecurity.com
A threat actor using stolen GitHub credentials has pushed a credential-stealing payload into tens of thousands of repositories since November 10. In more than 1,800 of them, the malware ran and shipped GitHub Actions secrets and cloud credentials to the attacker. Aikido spotted the campaign and named it wfx-loot.
By Mirko Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.