International
The Morning Dev

Only the news worth knowing

‹
 
S94/100

Supply-chain attack · high

Thousands of hijacked GitHub accounts used to push CI secret stealer

Tier S · Shit hits the fan – Drop everything

Who’s exposed: Repositories with write access by hijacked GitHub accounts running GitHub Actions

Tier S because: Core infrastructure AND exploited in the wild AND (full takeover OR secrets exposed)

Reach

Attack

Damage

Fix

Core infrastructure · Popular tool · Exploited in the wild · Full takeover · Secrets exposed · Supply chain

What to do

  1. Check your GitHub repositories for unexpected pull requests and malicious shell scripts pushed to default branches, as described in the Aikido and StepSecurity writeups.
  2. Rotate GitHub Actions secrets and cloud credentials in any repository where the stealer may have run.
  3. Review recent workflow runs for suspicious activity and revoke access for unknown collaborators.

The Brief

  • An attacker used stolen credentials for 4,837 GitHub accounts to plant a CI secret stealer in repositories those accounts could write to, starting Tuesday (per Aikido Security).
  • Pushes began November 10 and reached tens of thousands of repositories; the malware ran in more than 1,800 of them.
  • The payload, dubbed wfx, opened seemingly harmless pull requests and pushed a malicious shell script directly to default branches, executing through GitHub Actions.
  • Shipped GitHub Actions secrets and cloud credentials to the attacker where it ran.

Why it matters

If your repositories run GitHub Actions workflows, secrets stored in those repos or their CI environment, including cloud credentials, may have been exfiltrated and should be treated as compromised.

The checklist behind the tier

Checklist · 7 of 10 yes
YesHits tech teamsGitHub is a developer platform used by engineering teams to build and run software.
YesCore infrastructureCompromise of GitHub, the platform nearly every development team relies on.
YesPopular toolGitHub and its Actions CI are mainstream developer platforms used by many teams.
YesExploited in the wildHelp Net Security: the malware ran in more than 1,800 repositories, shipping secrets to the attacker.
NoPublic exploitNo source says exploit code or a step-by-step proof-of-concept was published.
NoRemote, no loginThe Hacker News: attacker used stolen credentials for 4,837 GitHub accounts, so authentication was needed.
YesFull takeoverThe Hacker News: attacker used stolen credentials for 4,837 accounts, a full account takeover.
YesSecrets exposedHelp Net Security: malware shipped GitHub Actions secrets and cloud credentials to the attacker.
YesSupply chainStep Security: malicious shell script pushed to default branches, executed through GitHub Actions to steal secrets.
NoNo fix yetNo source says a fix is missing or incomplete; this is an account-hijacking campaign, not a flaw awaiting a patch.

Timeline

  1. Campaign begins pushing credential-stealing payload into repositories

  2. Aikido Security and other researchers publish reports on the campaign

  3. Aikido Security's Blog

    Compromised GitHub accounts push CI secret stealer to tens of thousands of repositories

  4. The Hacker News

    Attacker Used 4,837 Hijacked GitHub Accounts to Run a CI Secret Stealer in 1,806+ Repositories

  5. Step Security Blog

    WFX Phantom: The GitHub Actions Secret Stealer That Deletes Its Tracks

  6. Help Net Security

    Check your GitHub repos: A secret stealer hit tens of thousands of them

  7. SecurityWeek

    Attacker Targets 60,000 GitHub Repositories in Credential Theft Campaign

  8. BleepingComputer

    Hackers compromise 4,800 GitHub accounts to steal cloud credentials

Full coverage · 6 sources

First seen · 6 sources · Full story page · How tiers are decided