Attacker plants credential-stealing code across GitHub repositories
Original title: Attacker Targets 60,000 GitHub Repositories in Credential Theft Campaign
Stolen developer and bot tokens, not a GitHub Actions bug, were used to probe 61,764 repositories from November 10.
Security firms say an attacker tested stolen access to more than 60,000 GitHub repositories and inserted credential-stealing code where permissions allowed. Aikido Security calls the operation wfx-loot and says it began November 10, with about 4,800 compromised accounts behind probe pull requests to 61,764 repositories. Aikido saw the stealer run in more than 1,800 repositories; SafeDep counted 8,093 public repositories with malicious commits, which does not prove execution. The code hunts tokens, secrets, cloud credentials and AI keys and can persist in AWS and Azure. Firms advise revoking tokens and rotating secrets.
Unconfirmed: How the Fly.io app tokens were obtained is unknown, with no evidence Fly.io was breached; execution counts differ by firm.
- Malware was placed in GitHub Actions workflows, CI shell scripts and npm install hooks.
- The script also reads GitHub Actions runner process memory.
- The attacker often reverted commits and deleted workflow runs.
- StepSecurity traced 173 probe pull requests to Fly.io GitHub app tokens.
- Aikido sees similarities to October’s GhostAction campaign but likely different actors.
Impact: Steals tokens, repository secrets, cloud credentials and AI keys
| Product | Affected |
|---|---|
| GitHub repositories and Actions workflows | — |
- 1.Revoke compromised GitHub tokens and rotate exposed secrets if the malware ran.
- 2.Check AWS and Azure for unauthorized access changes and new persistence.
- 3.Review repositories for malicious workflow, CI script or npm hook commits.
- ATT&CK
- T1078 Valid AccountsT1195.002 Compromise Software Supply ChainT1528 Steal Application Access TokenT1070 Indicator Removal
- Products
- GitHub Actionsnpm
- Malware
- wfx-loot
- Organizations
- Aikido SecurityStepSecuritySafeDep
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | fly.io | rmine how the tokens were obtained and had no evidence that Fly.io’s infrastructure had been breached. Affected software relea |
From the original article
2 min read at securityweek.com
Using thousands of hijacked accounts, the wfx-loot campaign planted a CI secret stealer that ran in over 1,800 GitHub repositories. The post Attacker Targets 60,000 GitHub Repositories in Credential Theft Campaign appeared first on SecurityWeek.
By Eduard Kovacs · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.