Security · High impactFan score 94 · Tier S6 sources

Attacker Targets 60,000 GitHub Repositories in Credential Theft Campaign

SecurityWeek · By Eduard Kovacs · 2d ago

The Brief · written from 6 sources

An attacker used stolen credentials for 4,837 GitHub accounts to plant a CI secret stealer in repositories those accounts could write to, starting Tuesday (per Aikido Security).
Pushes began November 10 and reached tens of thousands of repositories; the malware ran in more than 1,800 of them.
The payload, dubbed wfx, opened seemingly harmless pull requests and pushed a malicious shell script directly to default branches, executing through GitHub Actions.
Shipped GitHub Actions secrets and cloud credentials to the attacker where it ran.

Why it matters

If your repositories run GitHub Actions workflows, secrets stored in those repos or their CI environment, including cloud credentials, may have been exfiltrated and should be treated as compromised.

Who’s affected

Teams using GitHub Actions in repositories with write access from compromised accounts
Anyone storing cloud credentials or Actions secrets in affected repositories

What to do

Check your GitHub repositories for unexpected pull requests and malicious shell scripts pushed to default branches, as described in the Aikido and StepSecurity writeups.
Rotate GitHub Actions secrets and cloud credentials in any repository where the stealer may have run.
Review recent workflow runs for suspicious activity and revoke access for unknown collaborators.

Using thousands of hijacked accounts, the wfx-loot campaign planted a CI secret stealer that ran in over 1,800 GitHub repositories. The post Attacker Targets 60,000 GitHub Repositories in Credential Theft Campaign appeared first on SecurityWeek .

Read the full story at securityweek.com ↗