A GitHub credential theft campaign used 4,837 compromised accounts to check 61,764 repositories for write access on November 10. Researchers confirmed that the attacker stole secrets from at least 1,835 targets. The campaign, dubbed wfx-loot, sought credentials that software projects use to build, test and publish code.
The activity began around 12:45 UTC. The attacker opened pull requests titled docs: dependency audit notes, making them look like routine documentation updates. At the time of the researchers’ analysis, 92% of those requests remained open. The requests helped the attacker test account permissions, but their presence alone does not establish that a repository exposed any secrets.
GitHub credential theft reaches beyond repositories
The attacker targeted GitHub Actions, the service that many developers use to automate tasks such as testing code or deploying an application. Those tasks often need permission to access other services. As a result, the credentials available to a single workflow can extend well beyond GitHub.
The malicious code sought access to Amazon Web Services, Microsoft Azure and Google Cloud. It also targeted credentials for developer tools and AI services, including OpenAI, Anthropic and GitHub Copilot. Depending on the permissions a project had granted, the attacker could potentially retain access to a cloud account after the affected workflow ended.
Some compromised GitHub accounts had ties to Fortune 100 companies, the US General Services Administration, the French government and open-source projects including Nextcloud and WebdriverIO. Researchers also identified about 50 accounts that appeared to hold publishing rights in other software ecosystems, including npm, PyPI and Packagist.
Automated releases carry malicious code into packages
The investigation identified three package releases that contained the malicious code. On Packagist, it appeared in version 3.14.3 of digitalelvis/neuronai-studio. In the Go ecosystem, it reached versions v1.0.278 and v1.0.280 of github.com/onuragtas/docker-env. Researchers attributed those releases to automated publishing and concluded that stealing workflow secrets was the attacker’s primary objective.
Repository owners can look for a branch named wfx-docs, the audit-themed pull request and unexplained gaps in workflow run numbers. The attacker deleted some run records, so an apparently clean workflow history may be incomplete. Where investigators confirm that the malicious code ran, researchers advise teams to treat every secret and cloud role available to that workflow as compromised, rotate exposed credentials and review the affected cloud access.
0 responses to “GitHub credential theft hits at least 1,835 targets”