AI-generated infographic: wfx-loot github credential theft campaign. Its figures are taken from this article. Infographic: Grok.
By news editor
Attackers used stolen credentials for 4,837 GitHub accounts to open probe pull requests in 61,764 repositories, then pushed a script that steals build secrets and cloud credentials, according to Aikido, the application security company that identified the campaign. At least 1,835 repositories ran the script and had credentials exfiltrated, Aikido says.
The company tracks the activity as wfx-loot, a name built from the attacker's label for the malware and its term for stolen secrets. By Aikido's account it started at about 12:45 UTC on November 10. The post does not say how the GitHub credentials were stolen.
GitHub Actions, the service that runs automated build, test and release jobs called workflows, is the target. Those jobs often hold the secrets a company uses to reach its cloud accounts and package registries.
For each repository a stolen token could write to, Aikido says, the attacker opened a pull request titled "docs: dependency audit notes" to confirm write access, then delivered a shell script of about 1,500 lines through an existing workflow, an install hook or a new workflow on a short-lived branch. The changes were reverted within at most one minute, and the workflow run and its logs were deleted. Aikido writes: "A missing run number in the workflow's history is often the only trace."
Not all of the probes stayed inside the hijacked accounts' own projects. Aikido counts 10,431 pull requests that went into repositories the account does not own, reached through collaborator or organization access. Of the pull requests, the post says, 92% "are still open, which suggests most owners haven't noticed."
According to the post, the script is built to collect GitHub Actions secrets and tokens, credential files for AWS, Azure, Google Cloud, Docker, Kubernetes and other tools, and credentials for AI providers and coding tools including OpenAI, Anthropic, Gemini, Hugging Face, Cursor and Copilot. On runners a company hosts itself, it also takes cloud instance metadata credentials. Aikido adds that some of the script's exfiltration features were turned off in this campaign.
Rotating the stolen secrets may not end the exposure, by Aikido's description. In AWS the script can create long-lived credentials for users and rewrite a role's trust policy to open the role to any AWS account. In Azure it can add federated identity credentials to applications, which lets a workflow in the compromised repository sign in without a stored secret after every token has been rotated. The post does not say in how many cloud accounts those changes were made. Its instruction to repository owners reads: "If the payload ran in your repository, assume every secret and cloud role available to its workflows is compromised."
The figures are Aikido's own, described in the post as based on data collected so far, and the post carries no statement from GitHub. Elsewhere the post cites indications that the payload ran in at least 1,806 repositories, a different figure from the 1,835 in its summary, and says the number may understate the impact because run logs were deleted. It also says the script carries settings for private repositories, which suggests it may be running in private repositories as well as the public ones researchers can identify. Aikido names no affected companies and gives no estimate of financial loss.
Automated publishing carried the payload into one Packagist package, digitalelvis/neuronai-studio version 3.14.3, and two tagged versions of a Go module, where Aikido says it sits only in a workflow file that Go builds never run. At least 50 of the compromised users appear to publish packages for npm, Go, Packagist, PyPI or crates. Even so, Aikido's assessment is that the attacker "appears to be targeting CI secrets rather than attempting to proliferate through the supply chain." CI, or continuous integration, is the automated build pipeline.
Some of the accounts had been hit before. Aikido says accounts caught in the GhostAction campaign in October were significantly more likely than baseline to be hit by wfx-loot, and that in more than 100 repositories the new payload was injected into GhostAction's workflow files. It nonetheless assesses the two as distinct campaigns, likely carried out by different threat actors, citing differences in infrastructure, tooling and tradecraft.
Whether GitHub publishes its own account of the campaign, including how the credentials were obtained, is the next thing to watch. Aikido's counts rest on data collected so far and could change, and any growth in the list of affected packages would extend the exposure from repository owners to the companies that install that software.
Leave a Reply