Hackers have exploited 4,837 compromised GitHub accounts in a campaign known as wfx-loot, targeting public repositories to pilfer developer credentials, cloud keys, and tokens. According to research from Aikido Security, this illicit operation successfully executed malware in at least 1,835 repositories, raising significant concerns within the software development and cybersecurity communities.
The wfx-loot campaign initially surfaced on November 10, when attackers began opening pull requests labeled as “docs: dependency audit notes”—a tactic designed to test whether they could leverage stolen credentials to commit changes. These initial efforts did not deploy the credential-stealing payload immediately; however, they paved the way for subsequent malicious commits disguised as routine maintenance updates. Aikido Security’s findings suggest that the attackers displayed a sophisticated understanding of GitHub’s infrastructure, utilizing techniques such as modifications to existing GitHub Actions workflows, npm hooks, and even new workflows created in temporary branches to orchestrate the attack.
Recent investigations by StepSecurity revealed an additional method of delivering the payload by embedding it within existing shell scripts, which are typically executed by automated workflows. This stealthy approach allows for payload deployment without altering the workflow files, thereby evading initial detection. Once executed, the injected 1,500-line shell script methodically searches for various sensitive assets including SSH keys, cloud credentials, and other secrets. Attackers swiftly revert their changes and delete associated workflow runs and logs, often within a minute of execution, to obfuscate their activities.
The situation escalated when Fly.io, a cloud service provider, confirmed in a security notice that compromised GitHub tokens had been misused against customer repositories. An internal misconfiguration had left a GitHub access token exposed in a publicly accessible directory, facilitating the hackers’ access. While Fly.io assured its systems remained secure, this incident highlighted vulnerabilities arising from the intersection of application deployment processes and credential management, shedding light on how attackers could operationalize their gains in wfx-loot.
The payload’s capabilities extend beyond GitHub repositories; it seeks to exploit GitHub’s OpenID Connect authentication for gaining access to connected cloud services. Depending on the permissions of the stolen credentials, attackers could potentially create new AWS access keys, manipulate Azure applications, and target Google Cloud services as part of their broader campaign.
Subsequent examinations indicated ongoing malicious activity, with over 66,200 probing pull requests and malicious commits identified in more than 8,000 public repositories. The metrics gauged various stages of the attack, revealing that the campaign did not solely rely on executing malware—many repositories were also victims of credential theft without direct malicious code execution.
Faces behind this campaign have not been isolated to any single group, as Aikido’s reports intersect with previous attacks not directly related to the wfx-loot methodology. The overlap with repositories affected in past campaigns, such as GhostAction, suggests that different threat actors may be leveraging similar tactics to exploit vulnerabilities within the software development lifecycle.
Affected organizations are advised to conduct thorough reviews of their repositories for unusual activity, particularly for branches and commits related to “wfx-docs.” Furthermore, they should assess existing shell scripts, npm hooks, and workflow files. Given the sophisticated nature of the attack, merely removing malicious code does not mitigate the risk associated with already compromised credentials, which can sustain unauthorized access until all necessary tokens are revoked and credentials are rotated.
In conclusion, the wfx-loot incident illustrates the prevalent threat posed by adversaries that employ credential theft as a primary tactic for initial access and subsequent escalation, aligning with various MITRE ATT&CK techniques. It serves as a stark reminder of the importance of robust cybersecurity measures within development environments to safeguard against the exploitation of sensitive information.