Security · High impactFan score 93 · Tier S4 sources

WFX Phantom: The GitHub Actions Secret Stealer That Deletes Its Tracks

The Brief · written from 4 sources

An attacker used stolen credentials for 4,837 GitHub accounts to plant a secret stealer in repositories those accounts could write to, according to Aikido Security.
The payload runs in CI and is built to take secrets and cloud credentials; it has pushed into tens of thousands of repositories since November 10.
In more than 1,800 repositories the malware ran and shipped GitHub Actions secrets and cloud credentials to the attacker.

Why it matters

Any repository where the compromised accounts had write access, and where GitHub Actions secrets or cloud credentials are stored, may have leaked those secrets to the attacker.

Who’s affected

Developers and teams whose GitHub repositories use GitHub Actions
Owners of cloud credentials stored as CI secrets

What to do

Check your GitHub repositories for the injected secret stealer payload, as described by Aikido Security and the Help Net Security article
Rotate GitHub Actions secrets and cloud credentials that may have been exposed in CI runs

A coordinated botnet of compromised GitHub accounts launched a widespread attack, opening seemingly harmless pull requests before pushing a malicious shell script directly to default branches. The script, dubbed **wfx**, executed through GitHub Actions to steal secrets before the…

Read the full story at stepsecurity.io ↗