An attacker has tested stolen access to more than 60,000 GitHub repositories and inserted credential-stealing code in thousands of them, several security firms report.
Aikido Security said the operation, which it calls wfx-loot, began on November 10. It identified roughly 4,800 compromised accounts behind probe pull requests submitted to 61,764 repositories.
The requests were used to establish whether the stolen access permitted changes to a repository. “The pull request does nothing by itself,” StepSecurity explained, noting that malware was subsequently deployed in repositories where the permissions and configuration allowed it.
Aikido found signs that the stealer ran in more than 1,800 repositories. SafeDep separately counted 8,093 public repositories that received malicious commits, a figure that does not necessarily indicate successful execution.
“The attacker does not exploit a bug in GitHub Actions,” StepSecurity noted. The intruder instead relies on valid tokens belonging to developer and bot accounts.
The attacker placed the malware in existing or new GitHub Actions workflows, shell scripts run by CI systems, and npm installation hooks. The npm method also poses a risk to developers who install dependencies while the malicious changes are present.
The script looks for GitHub tokens, repository secrets, cloud credentials and AI service keys. It also reads GitHub Actions runner process memory and has functionality designed to expand access and establish persistence in AWS and Azure.
The attacker usually reversed the code changes and deleted workflow runs to conceal the activity.
StepSecurity traced 173 probe pull requests to tokens issued to the Fly.io GitHub app. The firm said it could not determine how the tokens were obtained and had no evidence that Fly.io’s infrastructure had been breached.
Affected software releases include a Packagist package and versions of two Go modules.
Aikido identified similarities with October’s GhostAction campaign but assessed that the two operations probably involved different actors.
The security firm warned that organizations should assume all accessible secrets were compromised if the malware executed. Organizations have been advised to revoke compromised tokens, rotate exposed secrets, and check for unauthorized cloud changes.
Related: Notion Customer Data Compromised in Fireworks AI Hack
Related: 500,000 Active Credentials Left Exposed on GitHub
Related: Meta Says Hackers Took Code, Personal Data of 1,500 in GitHub Breach
