Campaign uses 4,837 stolen GitHub accounts to steal secrets and cloud credentials

A campaign dubbed "wfx-loot" has used credentials from 4,837 compromised GitHub accounts to probe 61,764 repositories for write permissions, according to researchers at application security company Aikido cited by BleepingComputer. Aikido places the start at around 12:45 UTC on November 10 and published its analysis on November 12.

According to that research, the attacker opened pull requests titled "docs: dependency audit notes" and, where it had permissions, introduced a script of about 1,500 lines that modified or added GitHub Actions workflows, or an npm install hook. The script tried to collect GitHub Actions secrets, AWS, Azure and Google Cloud credentials, development and infrastructure keys and AI service credentials, and then deleted the changes, runs and logs in under a minute, again according to Aikido.

The researchers confirmed that secrets were stolen from at least 1,835 targets, although not all repositories ran the code. The compromised accounts included some belonging to Fortune 100 organizations, the US General Services Administration, the French government, Nextcloud and WebdriverIO, and about 50 appear to have rights to publish to package registries such as npm, PyPI, Go, crates and Packagist, according to BleepingComputer.

Automated publishing carried the malicious code into a Packagist package and two versions of a Go module, according to Aikido, which recommends immediately rotating all secrets and cloud roles of the affected workflows. The campaign has not been attributed to any actor and GitHub has not commented on the case in the pages consulted.