Hackers compromise 4,800 GitHub accounts to steal cloud credentials
Tens of thousands of GitHub repositories were targeted in a campaign dubbed ‘wfx-loot’ that uses malicious workflows to steal GitHub Actions secrets and cloud credentials.
Tens of thousands of GitHub repositories were targeted in a campaign dubbed ‘wfx-loot’ that uses malicious workflows to steal GitHub Actions secrets and cloud credentials.
Although not all repositories ran the payload, researchers confirmed that the threat actor stole secrets from at least 1,835 targets.
The threat actor used thousands of compromised GitHub accounts to open pull requests against repositories those accounts could access, testing whether they had sufficient write permissions to inject malicious code.
Aikido says the wfx-loot campaign began around 12:45 UTC on November 10, when the attacker used stolen GitHub credentials from 4,837 compromised accounts to probe 61,764 repositories for write access.
Of those pull requests, 92% remain open, Aikido reports, suggesting the legitimate repository owners did not notice the activity.
They then delivered a 1,500-line credential-stealing shell script by modifying an existing GitHub Actions workflow, adding a new workflow on a short-lived branch, or planting an npm install hook.
Some of the compromised accounts belonged to Fortune 100 organizations, the US General Services Administration, the French government, Nextcloud, and WebdriverIO.
According to researchers at application security company Aikido, about 50 of them appear to have publishing rights on other open-source software ecosystems and package indexes such as npm, PyPI, Go, crates, and Packagist.
The script also supports cloud privilege escalation by exchanging GitHub OIDC tokens for temporary AWS, Azure, and GCP cloud sessions; in AWS, it can chain into more IAM (identity and access management) roles present in the repository
It also uses collected service-account credentials to impersonate identities in GCP.
Aikido notes that capabilities include establishing persistent access by creating long-lived credentials or modifying cloud identity and trust policies where permissions allow.
The researchers believe the threat actor's primary objective was to steal CI secrets, while the package releases were a byproduct of automated publishing.
Where payload execution is confirmed, all secrets and cloud roles available to the affected workflows should be considered compromised and rotated immediately.
Microsoft is investigating a widespread outage affecting multiple Microsoft 365 services, including Outlook, Microsoft Teams, and Copilot, as users report connectivity problems worldwide.
What happened
Tens of thousands of GitHub repositories were targeted in a campaign dubbed ‘wfx-loot’ that uses malicious workflows to steal GitHub Actions secrets and cloud credentials.
Although not all repositories ran the payload, researchers confirmed that the threat actor stole secrets from at least 1,835 targets.
The threat actor used thousands of compromised GitHub accounts to open pull requests against repositories those accounts could access, testing whether they had sufficient write permissions to inject malicious code.
What changed
Aikido says the wfx-loot campaign began around 12:45 UTC on November 10, when the attacker used stolen GitHub credentials from 4,837 compromised accounts to probe 61,764 repositories for write access.
Of those pull requests, 92% remain open, Aikido reports, suggesting the legitimate repository owners did not notice the activity.
They then delivered a 1,500-line credential-stealing shell script by modifying an existing GitHub Actions workflow, adding a new workflow on a short-lived branch, or planting an npm install hook.
Who is affected
Some of the compromised accounts belonged to Fortune 100 organizations, the US General Services Administration, the French government, Nextcloud, and WebdriverIO.
According to researchers at application security company Aikido, about 50 of them appear to have publishing rights on other open-source software ecosystems and package indexes such as npm, PyPI, Go, crates, and Packagist.
Why it matters
The script also supports cloud privilege escalation by exchanging GitHub OIDC tokens for temporary AWS, Azure, and GCP cloud sessions; in AWS, it can chain into more IAM (identity and access management) roles present in the repository
Technical details
It also uses collected service-account credentials to impersonate identities in GCP.
Aikido notes that capabilities include establishing persistent access by creating long-lived credentials or modifying cloud identity and trust policies where permissions allow.
Response
The researchers believe the threat actor's primary objective was to steal CI secrets, while the package releases were a byproduct of automated publishing.
Where payload execution is confirmed, all secrets and cloud roles available to the affected workflows should be considered compromised and rotated immediately.
What remains unknown
It is not clear whether the stealer followed.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.