A sophisticated threat campaign has compromised thousands of GitHub accounts to target software repositories and harvest sensitive cloud credentials, according to a recent report by cybersecurity firm Aikido. The malicious activity, tracked as wfx-loot, utilized thousands of hijacked developer profiles to automate reconnaissance and deploy infostealer scripts across tens of thousands of projects on the popular software development platform.
GitHub serves as a central hub for developers managing open-source projects, housing source code and configuration files within individual repositories. Developers collaborate by proposing changes through pull requests, while built-in automation features like GitHub Actions and workflows execute predefined tasks and instructions. Crucially, these automated workflows often require access to sensitive credentials to complete their designated tasks, making them an attractive target for bad actors looking to escalate privileges and siphon valuable configuration data.
Key takeaways
- Threat actors utilized 4,837 compromised GitHub accounts to open pull requests across 61,764 repositories.
- At least 1,835 repositories successfully executed the malicious payload, resulting in widespread credential exfiltration.
- The stolen data included authentication tokens along with AWS, Azure, and Google Cloud credentials.
- Attackers deleted workflow execution logs and reverted changes within minutes to evade detection.
How the wfx-loot campaign operated
According to the Aikido researchers, the campaign began with automated probes designed to determine which projects the attackers could modify. The threat actors used compromised accounts to open pull requests titled docs: dependency audit notes from branches named wfx-docs. Out of more than 60,000 matching pull requests, over 10,000 targeted repositories that the compromised accounts did not personally own but still possessed write access to.
Once write access was established, the perpetrators deployed a malicious script using one of three distinct methods: modifying existing GitHub Actions workflows, adding a shell script triggered by an npm installation hook, or creating an entirely new workflow file on a temporary branch. The core payload consisted of roughly 1,500 lines of code engineered to hunt down sensitive information hidden within the compromised environments.
Scope of the breach and impacted assets
The deployed malware systematically searched for GitHub Actions secrets, authentication tokens, AWS, Azure, and Google Cloud credentials, Docker and Kubernetes configuration files, SSH keys, and API keys tied to AI services such as OpenAI and Anthropic. Furthermore, the script scanned for developers' shell histories, private keys, environment files, and credentials associated with development tools like npm, PyPI, HashiCorp Vault, and Terraform.
To maximize persistence, the malware attempted to expand access by exchanging stolen tokens for cloud sessions, spoofing service accounts, and generating new credentials. It also altered AWS and Azure configurations to maintain access even if victims attempted to rotate their compromised passwords. Aikido reported that at least 1,835 repositories executed the payload. To cover their tracks, the attackers quickly reverted changes and deleted workflow execution logs, sometimes within a single minute. The campaign also spilled into the broader software supply chain, impacting PHP packages on Packagist and two Go module versions, which researchers believe was a byproduct of abused automated publishing pipelines. Security experts advise any repository owner whose project executed the payload to immediately treat all accessible cloud secrets and credentials as fully compromised and rotate them urgently.
Comments