Since Tuesday, an attacker has used stolen credentials for 4,837 GitHub accounts to plant a secret stealer in repositories those accounts could write to, according to software security firm Aikido Security, which calls the operation wfx-loot. Each attack started with an innocuous-looking pull request that tested whether the account had write access; such requests were opened in 61,764 repositories. According to Aikido, the stealer actually ran in at least 1,806 repositories. SafeDep counted 8,093 public repositories that received malicious commits.
The code was placed in existing or new GitHub Actions workflows and, in some cases, as an npm install hook, which also runs on a developer's machine. It collects repository secrets, tokens, AI service keys and credentials for AWS, Azure and GCP, and in some cases sets up persistent access to cloud accounts that survives credential rotation. After running, the attacker usually reverted the change and deleted the run logs. According to StepSecurity, the attacker does not exploit a bug in GitHub Actions but relies on valid tokens of developer and bot accounts; how they were obtained is not yet known.
What to do: owners of affected repositories should revoke the committing account's tokens, SSH keys and app grants, turn on two-factor authentication, and rotate every secret the repository can read. Anyone who ran npm install on an affected commit should treat that machine as compromised and rotate its keys. It is also worth checking cloud accounts for unauthorized changes.
