Hijacked GitHub accounts plant secret-stealing malware in thousands of repos
Original title: Thousands of GitHub repos hit with secret-stealing malware
The script also rewrites AWS role trust and injects Azure federated credentials so access can survive rotation.
Aikido Security says attackers used 4,837 hijacked GitHub accounts to open probe pull requests in 61,764 repositories starting November 10, then committed a shell script that collects CI/CD secrets, cloud credentials, and AI API keys. Indications show the payload ran in at least 1,806 repositories; commits were often reverted and logs deleted within a minute. GitHub held malicious workflow changes for approval, but an npm postinstall hook still ran. Later versions send stolen data only to a Telegram chat.
Unconfirmed: Aikido says 1,806 confirmed runs may understate impact, and some leaked Fly.io tokens may still be valid.
- About 92% of pull requests titled “docs: dependency audit notes” were still open.
- The payload is a roughly 1,500-line shell script that also scans runner process memory.
- Published copies include Packagist neuronai-studio 3.14.3 and Go modules docker-env and gocurl.
- GitGuardian said about a fifth of the accounts were previously hit in GhostAction.
- Fly.io said some GitHub App tokens leaked via .git/config in publicly served build directories.
Impact: CI/CD secrets, cloud credentials, and AI API keys stolen
| Product | Affected |
|---|---|
| Packagist neuronai-studio | 3.14.3 |
| docker-env | — |
| gocurl | — |
- 1.If campaign pull requests or commits appear, rotate repository, organization, registry, and cloud secrets.
- 2.Hunt AWS trusts accepting any account, IAM keys created since November 10, and Azure credentials named wfx-ci-*.
- 3.Treat machines that installed Packagist neuronai-studio 3.14.3 as compromised.
- ATT&CK
- T1078 Valid AccountsT1195.002 Compromise Software Supply ChainT1552 Unsecured CredentialsT1098.001 Additional Cloud CredentialsT1567 Exfiltration Over Web Service
- Malware
- wfx-loot
- Organizations
- Aikido SecurityGitGuardianStepSecurityArmorCode
From the original article
4 min read at csoonline.com
Researchers have uncovered a campaign in which hijacked GitHub accounts spread secret-stealing malware across thousands of repositories. The payload executed in at least 1,806 repos, exfiltrating CI/CD secrets and cloud credentials. Aikido Security, which detected and documented the campaign, said the attackers used the 4,837 compromised accounts to open probe pull requests in 61,764 repositories starting Nov.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.