wfx-loot campaign: 4,837 hijacked GitHub accounts used to plant a CI secret stealer in thousands of repositories

Linha do tempo

1. securityweek.com ↗ · pub. 12/11/2026 10:39 · coletado 12/11 11:00

   Credential Theft Campaign Compromises Over 60,000 GitHub Repositories with Malicious Code

   ler a análise desta fonte ocultar

   Security researchers have uncovered an ongoing attack campaign, dubbed wfx-loot, targeting over 60,000 GitHub repositories by employing stolen credentials to insert credential-stealing malware. Starting November 10, attackers tested stolen access accounts via probe pull requests to determine if code insertion was possible before deploying malware in thousands of repositories. The malicious code aimed at harvesting GitHub tokens, repository secrets, cloud credentials, and AI service keys, with capabilities to persist and expand access in AWS and Azure environments. The attacker deployed malware through malicious GitHub Actions workflows, shell scripts, and npm installation hooks, posing a broader risk to developers who install dependencies during the infection window. The campaign relies on compromised tokens, not GitHub vulnerabilities, complicating detection and mitigation efforts. Organizations affected are urged to assume full secret compromise, revoke exposed tokens, rotate all secrets, and verify their cloud environments for unauthorized changes. Similarities to the prior GhostAction campaign exist but likely involve distinct actors.

2. helpnetsecurity.com ↗ · pub. 12/11/2026 06:24 · coletado 12/11 07:03

   Wfx-loot campaign steals GitHub Actions secrets from tens of thousands of repositories

   ler a análise desta fonte ocultar

   Since November 10, a threat actor has exploited stolen GitHub credentials to insert a credential-stealing payload into over 61,000 repositories, impacting nearly 5,000 compromised accounts. This malware, called wfx-loot by researcher Aikido, targets GitHub Actions workflows to exfiltrate secrets including cloud and SSH credentials, AI tool tokens, and package registry keys. The attacker uses these stolen credentials to gain unauthorized access to AWS, GCP, and Azure cloud environments, including creating long-lived AWS access keys and altering Azure federated identity configurations to maintain persistent access even after secret rotation. The campaign also manipulates branch protections by forging passing status checks, enabling further unauthorized code changes. Automated package publishing workflows spread the payload into packages on npm, Packagist, Go modules, PyPI, and crates, with affected packages including digitalelvis/neuronai-studio and github.com/onuragtas/docker-env. Detection involves looking for suspicious pull requests and branch names such as "wfx-docs" or commits titled "ci: refresh build cache." The campaign is separate from the earlier GhostAction campaign but overlaps in targeting some accounts.

3. gbhackers.com ↗ · pub. 12/11/2026 03:37 · coletado 12/11 05:00

   Massive Credential Theft Breach Compromises Nearly 5,000 GitHub Accounts to Steal Software Development Secrets

   ler a análise desta fonte ocultar

   In early November 2026, threat actors compromised the credentials of 4,837 GitHub accounts to access and probe 61,764 repositories focusing on stealing secrets from software development pipelines and cloud environments. The attackers used stolen credentials to inject malicious workflows, resulting in exfiltration of GitHub Actions secrets, workflow tokens, runtime credentials, and cloud access credentials including AWS, Google Cloud, and Azure. This campaign involved deploying malicious payload variants through continuous integration (CI) workflows, with attackers reverting changes rapidly to evade detection. At least 1,806 repositories showed evidence of credential exfiltration, and multiple repositories used by publicly published package maintainers were affected, creating risk for downstream supply chain compromise. The attackers also deployed persistence techniques such as modifying AWS trust policies and injecting Azure federated identity credentials, allowing prolonged access despite secret rotations. Investigation and remediation require thorough review of deleted workflows, cloud identity changes, and exposed developer environments rather than only rotating tokens or removing malicious files. Although some overlap with prior GhostAction activity was observed, researchers did not attribute it to the same threat actor due to differing tactics and tooling.

   Technical Details

   Attackers initiated access by submitting pull requests that appeared as routine documentation changes, testing for write access with stolen credentials. Subsequent insertion of large workflow modifications or small scripts enabled secret collection via GitHub Actions, including continuous integration credentials and pod environment information. The campaign gathers extensive data including repository contents, Git history, build artifacts, and AI service credentials. The exfiltration channel observed was HTTP POST traffic to IPs 194.150.166[.]244:8080/exfil and 18.143.168[.]96:8080/exfil. Payloads affected package ecosystems including npm, Go, Packagist, and PyPI but primarily targeted CI credentials over package propagation. Persistence involves cloud token exchanges such as IAM role chaining and Azure token replay.

   Remediation

   Organizations should treat all secrets and cloud roles accessed through workflows as compromised. Investigations must include audit of deleted workflow runs, suspicious commits, cloud identity permissions, and developer endpoint exposure. Remediation cannot rely solely on token rotation or deleting malicious workflows due to persistence mechanisms. Providers and maintainers across multiple package ecosystems should review their roles and releases.

   Vendor: GitHub Targeted Sectors: software development Attack Type: credential compromise, supply_chain Initial Access Vector: stolen credentials Threat Actors: unknown Malware Families: credential stealer Indicators of Compromise: 194.150.166[.]244:8080/exfil, 18.143.168[.]96:8080/exfil Affected Projects: Packagist digitalelvis/neuronai-studio 3.14.3, Go module github.com/onuragtas/docker-env v1.0.278 and v1.0.280

   Urgency

   The incident severity is high due to large-scale credential theft, broad exfiltration of sensitive CI and cloud secrets, and advanced persistence mechanisms that complicate remediation and increase risk to software supply chains.

4. thehackernews.com ↗ · pub. 12/11/2026 03:42 · coletado 12/11 05:00

   Massive Credential Theft Campaign Using 4,837 Hijacked GitHub Accounts to Deploy CI Secret Stealer

   ler a análise desta fonte ocultar

   Starting November 10, 2026, attackers used stolen credentials from 4,837 GitHub accounts to plant a sophisticated secret stealer targeting CI workflows in over 1,800 repositories, with malicious activity observed in upwards of 8,000 public repositories. The campaign involved opening pull requests titled "docs: dependency audit notes" to test write access and subsequently injecting a stealer designed to exfiltrate secrets and cloud credentials from GitHub Actions workflows, including AWS, Azure, GCP, npm, and other environments. The stealer also attempted persistence by rewriting trust policies and adding federated identity credentials, enabling long-term unauthorized access despite secret rotation. Key indicators include specific commit messages, branch naming patterns, and a known stealer SHA-256 hash. Users are advised to revoke all related tokens, rotate credentials, enable two-factor authentication, and consider affected machines compromised, especially if npm install was run on tainted packages.

5. safedep.io ↗ · pub. 11/11/2026 21:00 · coletado 12/11 03:01 primeiro registro

   Wfx GitHub Actions Credential Stealer Infects Over 8,000 Repositories via Stolen Tokens and Cloud Backdoors

   ler a análise desta fonte ocultar

   A widespread campaign using stolen GitHub tokens has infected more than 8,000 public repositories by pushing malicious commits containing a credential stealer dubbed 'wfx'. The malware executes in GitHub Actions workflows or during npm install, harvesting repository secrets, runtime tokens, and extensive cloud credentials from AWS, Azure, and GCP. It attempts to maintain persistence by planting backdoors in cloud environments that survive secret rotations, including federated Azure credentials and AWS access keys. The attacker authenticates commits as repository collaborators using stolen tokens and reverts changes post-execution to avoid detection. Two package registries (Packagist and Go module proxy) have been used to distribute the payload embedded in legitimate package releases. Repository owners are advised to immediately revoke affected tokens, rotate all secrets exposed to the workflow, delete malicious branches, and audit their cloud accounts for unauthorized federated credentials and access keys.