Wfx GitHub Actions Credential Stealer Infects Over 8,000 Repositories via Stolen Tokens and Cloud Backdoors
A widespread campaign using stolen GitHub tokens has infected more than 8,000 public repositories by pushing malicious commits containing a credential stealer dubbed 'wfx'. The malware executes in GitHub Actions workflows or during npm install, harvesting repository secrets, runtime tokens, and extensive cloud credentials from AWS, Azure, and GCP. It attempts to maintain persistence by planting backdoors in cloud environments that survive secret rotations, including federated Azure credentials and AWS access keys. The attacker authenticates commits as repository collaborators using stolen tokens and reverts changes post-execution to avoid detection. Two package registries (Packagist and Go module proxy) have been used to distribute the payload embedded in legitimate package releases. Repository owners are advised to immediately revoke affected tokens, rotate all secrets exposed to the workflow, delete malicious branches, and audit their cloud accounts for unauthorized federated credentials and access keys.
Linha do tempo
-
Wfx GitHub Actions Credential Stealer Infects Over 8,000 Repositories via Stolen Tokens and Cloud Backdoors
ler a análise desta fonte ocultar
A widespread campaign using stolen GitHub tokens has infected more than 8,000 public repositories by pushing malicious commits containing a credential stealer dubbed 'wfx'. The malware executes in GitHub Actions workflows or during npm install, harvesting repository secrets, runtime tokens, and extensive cloud credentials from AWS, Azure, and GCP. It attempts to maintain persistence by planting backdoors in cloud environments that survive secret rotations, including federated Azure credentials and AWS access keys. The attacker authenticates commits as repository collaborators using stolen tokens and reverts changes post-execution to avoid detection. Two package registries (Packagist and Go module proxy) have been used to distribute the payload embedded in legitimate package releases. Repository owners are advised to immediately revoke affected tokens, rotate all secrets exposed to the workflow, delete malicious branches, and audit their cloud accounts for unauthorized federated credentials and access keys.