Wfx-loot Campaign Uses 4,837 Stolen GitHub Accounts to Steal Secrets from Over 1,800 Repositories
The wfx-loot attack campaign, identified by Aikido Security and StepSecurity, has leveraged 4,837 compromised GitHub accounts to target 61,764 repositories, with credential-stealing malware executed in at least 1,835 cases. The attackers used probe pull requests to test write access before introducing malicious commits that implant a roughly 1,500-line shell script designed to steal a wide range of credentials, including GitHub secrets, cloud tokens, SSH keys, and AI service credentials. The malware attempts lateral movement by exploiting permissions and GitHub’s OpenID Connect to access cloud environments such as AWS, Azure, and Google Cloud. Fly.io confirmed token exposure due to misconfigured deployments, which contributed some compromised credentials. Recent variants of the payload exfiltrate data via Telegram, evading IP blocking defenses. Recovery requires secret revocation and thorough checks of workflows and cloud permissions. The campaign exploits stolen credentials rather than software vulnerabilities, highlighting the need for credential hygiene and monitoring of CI/CD pipelines.
Linha do tempo
-
Wfx-loot Campaign Uses 4,837 Stolen GitHub Accounts to Steal Secrets from Over 1,800 Repositories
ler a análise desta fonte ocultar
The wfx-loot attack campaign, identified by Aikido Security and StepSecurity, has leveraged 4,837 compromised GitHub accounts to target 61,764 repositories, with credential-stealing malware executed in at least 1,835 cases. The attackers used probe pull requests to test write access before introducing malicious commits that implant a roughly 1,500-line shell script designed to steal a wide range of credentials, including GitHub secrets, cloud tokens, SSH keys, and AI service credentials. The malware attempts lateral movement by exploiting permissions and GitHub’s OpenID Connect to access cloud environments such as AWS, Azure, and Google Cloud. Fly.io confirmed token exposure due to misconfigured deployments, which contributed some compromised credentials. Recent variants of the payload exfiltrate data via Telegram, evading IP blocking defenses. Recovery requires secret revocation and thorough checks of workflows and cloud permissions. The campaign exploits stolen credentials rather than software vulnerabilities, highlighting the need for credential hygiene and monitoring of CI/CD pipelines.