Hackers compromise 4,800 GitHub accounts in wfx-loot campaign to steal CI and cloud credentials
A mass attack campaign dubbed 'wfx-loot' compromised 4,837 GitHub accounts to steal secrets from at least 1,835 repositories via malicious GitHub Actions workflows. The attackers opened pull requests titled "docs: dependency audit notes" to test write access, then injected a 1,500-line script to steal GitHub Actions tokens, cloud credentials (AWS, Azure, GCP), developer credentials, and AI service keys. Collected data was exfiltrated quickly before changes were reverted and logs deleted within a minute. Notable victims include Fortune 100 companies and government entities. The script also enables privilege escalation by exchanging OIDC tokens for temporary cloud sessions and creating long-lived credentials where allowed. Researchers advise checking for related suspicious branches and rotating any potentially compromised credentials immediately. The campaign overlaps partially with the 2025 GhostAction campaign.
Linha do tempo
-
Hackers compromise 4,800 GitHub accounts in wfx-loot campaign to steal CI and cloud credentials
ler a análise desta fonte ocultar
A mass attack campaign dubbed 'wfx-loot' compromised 4,837 GitHub accounts to steal secrets from at least 1,835 repositories via malicious GitHub Actions workflows. The attackers opened pull requests titled "docs: dependency audit notes" to test write access, then injected a 1,500-line script to steal GitHub Actions tokens, cloud credentials (AWS, Azure, GCP), developer credentials, and AI service keys. Collected data was exfiltrated quickly before changes were reverted and logs deleted within a minute. Notable victims include Fortune 100 companies and government entities. The script also enables privilege escalation by exchanging OIDC tokens for temporary cloud sessions and creating long-lived credentials where allowed. Researchers advise checking for related suspicious branches and rotating any potentially compromised credentials immediately. The campaign overlaps partially with the 2025 GhostAction campaign.