Credential Theft Campaign Compromises Over 60,000 GitHub Repositories with Malicious Code
Security researchers have uncovered an ongoing attack campaign, dubbed wfx-loot, targeting over 60,000 GitHub repositories by employing stolen credentials to insert credential-stealing malware. Starting November 10, attackers tested stolen access accounts via probe pull requests to determine if code insertion was possible before deploying malware in thousands of repositories. The malicious code aimed at harvesting GitHub tokens, repository secrets, cloud credentials, and AI service keys, with capabilities to persist and expand access in AWS and Azure environments. The attacker deployed malware through malicious GitHub Actions workflows, shell scripts, and npm installation hooks, posing a broader risk to developers who install dependencies during the infection window. The campaign relies on compromised tokens, not GitHub vulnerabilities, complicating detection and mitigation efforts. Organizations affected are urged to assume full secret compromise, revoke exposed tokens, rotate all secrets, and verify their cloud environments for unauthorized changes. Similarities to the prior GhostAction campaign exist but likely involve distinct actors.
Linha do tempo
-
Credential Theft Campaign Compromises Over 60,000 GitHub Repositories with Malicious Code
ler a análise desta fonte ocultar
Security researchers have uncovered an ongoing attack campaign, dubbed wfx-loot, targeting over 60,000 GitHub repositories by employing stolen credentials to insert credential-stealing malware. Starting November 10, attackers tested stolen access accounts via probe pull requests to determine if code insertion was possible before deploying malware in thousands of repositories. The malicious code aimed at harvesting GitHub tokens, repository secrets, cloud credentials, and AI service keys, with capabilities to persist and expand access in AWS and Azure environments. The attacker deployed malware through malicious GitHub Actions workflows, shell scripts, and npm installation hooks, posing a broader risk to developers who install dependencies during the infection window. The campaign relies on compromised tokens, not GitHub vulnerabilities, complicating detection and mitigation efforts. Organizations affected are urged to assume full secret compromise, revoke exposed tokens, rotate all secrets, and verify their cloud environments for unauthorized changes. Similarities to the prior GhostAction campaign exist but likely involve distinct actors.