From TechRadar · · 2m
GitHub attack steals cloud credentials from 4,800 accounts
Attackers used compromised GitHub accounts to inject malware into thousands of repositories and steal cloud login credentials and secrets.
In brief
Attackers used compromised GitHub accounts to inject malware into thousands of repositories and steal cloud login credentials and secrets. Threat actors compromised 4,837 GitHub accounts to deploy credential-stealing malware across 61,764 repositories, successfully exfiltrating secrets from at least 1,835 projects…
Thousands of GitHub repos targeted
Threat actors used 4,837 compromised GitHub accounts to open pull requests across 61,764 repositories, according to cybersecurity researchers Aikido.
How GitHub Actions work
GitHub Actions is an automation service that executes tasks through workflows, sets of instructions telling GitHub what to do. Workflows can access sensitive credentials when performing tasks.
Pull requests as reconnaissance
The pull requests titled docs: dependency audit notes were probes to see which projects the attackers could modify. Over ten thousand targeted repositories the compromised accounts could access but did not own.
Three methods to deploy malware
After establishing write access, attackers used three methods: modifying existing GitHub Actions workflows, adding a shell script triggered by npm installation, or creating a new workflow file on a temporary branch.
What the malware searched for
The roughly one thousand five hundred line payload searched for GitHub Actions secrets, authentication tokens, AWS, Azure and Google Cloud credentials, Docker and Kubernetes files, SSH keys, API keys for OpenAI and Anthropic, and developers'…
Expanding access and covering tracks
The malware exchanged stolen tokens for cloud sessions, spoofed service accounts, and created new credentials.
Scale of successful attacks
At least one thousand eight hundred thirty-five repositories executed the payload and had credentials exfiltrated.
“We're tracking this campaign as wfx-loot based on the threat actor's name for the malware and the term used for stolen secrets.”
Supply chain spillover
Aikido found compromised PHP packages on Packagist and two affected Go module versions, though researchers said this might have been a side-effect of attackers abusing automated publishing processes rather than planned.
What victims must do now
Aikido advises anyone whose repository executed the malicious payload to consider all secrets and cloud credentials their workflows can access as compromised and needing urgent rotation.
The headline
Threat actors compromised 4,837 GitHub accounts to deploy credential-stealing malware across 61,764 repositories, successfully exfiltrating secrets from at least 1,835 projects.
