Wfx-loot campaign steals GitHub Actions secrets from tens of thousands of repositories
Since November 10, a threat actor has exploited stolen GitHub credentials to insert a credential-stealing payload into over 61,000 repositories, impacting nearly 5,000 compromised accounts. This malware, called wfx-loot by researcher Aikido, targets GitHub Actions workflows to exfiltrate secrets including cloud and SSH credentials, AI tool tokens, and package registry keys. The attacker uses these stolen credentials to gain unauthorized access to AWS, GCP, and Azure cloud environments, including creating long-lived AWS access keys and altering Azure federated identity configurations to maintain persistent access even after secret rotation. The campaign also manipulates branch protections by forging passing status checks, enabling further unauthorized code changes. Automated package publishing workflows spread the payload into packages on npm, Packagist, Go modules, PyPI, and crates, with affected packages including digitalelvis/neuronai-studio and github.com/onuragtas/docker-env. Detection involves looking for suspicious pull requests and branch names such as "wfx-docs" or commits titled "ci: refresh build cache." The campaign is separate from the earlier GhostAction campaign but overlaps in targeting some accounts.
Linha do tempo
-
Wfx-loot campaign steals GitHub Actions secrets from tens of thousands of repositories
ler a análise desta fonte ocultar
Since November 10, a threat actor has exploited stolen GitHub credentials to insert a credential-stealing payload into over 61,000 repositories, impacting nearly 5,000 compromised accounts. This malware, called wfx-loot by researcher Aikido, targets GitHub Actions workflows to exfiltrate secrets including cloud and SSH credentials, AI tool tokens, and package registry keys. The attacker uses these stolen credentials to gain unauthorized access to AWS, GCP, and Azure cloud environments, including creating long-lived AWS access keys and altering Azure federated identity configurations to maintain persistent access even after secret rotation. The campaign also manipulates branch protections by forging passing status checks, enabling further unauthorized code changes. Automated package publishing workflows spread the payload into packages on npm, Packagist, Go modules, PyPI, and crates, with affected packages including digitalelvis/neuronai-studio and github.com/onuragtas/docker-env. Detection involves looking for suspicious pull requests and branch names such as "wfx-docs" or commits titled "ci: refresh build cache." The campaign is separate from the earlier GhostAction campaign but overlaps in targeting some accounts.