Attacker Used 4,837 Hijacked GitHub Accounts to Run a CI Secret Stealer in 1,806+ Repositories - The Hacker News

Starting Tuesday, attackers used stolen credentials for 4,837 GitHub accounts to plant a secret stealer in repositories those accounts could access. The malicious code was designed to extract secrets and cloud credentials accessible through CI workflows, affecting at least 1,806 repositories according to Aikido Security, a security software company.

The attack began with test pull requests titled 'docs: dependency audit notes' opened from branches named 'wfx-docs' to determine if the compromised accounts could write to repositories. These test requests were opened in 61,764 repositories, with the stealer subsequently deployed in some of them. After pushing the malicious code, attackers typically reverted the changes within minutes, though logs were often deleted along with the runs.

Scope of the Attack

In a separate analysis, SafeDep researchers counted 8,093 repositories that received malicious commits between Tuesday and early Wednesday. The count only included default branches of public repositories, suggesting the actual total is higher. In 7,309 repositories, the stealer was added to existing workflows, while in 771 cases, it was delivered as an npm postinstall hook.

Detection and Remediation

Researchers have identified several indicators of compromise, including specific branch names ('wfx-docs', 'chore/[a-z0-9]{8}', 'ci-check-[0-9]{4}'), pull request titles, and commit messages. The stealer script has a known SHA-256 hash (89695abb392d5cfd4972672961e644bb46baa98aa1ed7173c2a2816c762735cf) and communicates with specific IP addresses.

SafeDep recommends that repository owners revoke all tokens, OAuth app grants, SSH keys, and sessions from affected accounts, enable 2FA, and rotate all secrets and variables accessible to the repository. Anyone who ran npm install on an affected commit should treat that machine as compromised and rotate its keys.

Impact on Package Ecosystem

The attack reached at least one Packagist package and one Go module through automated publishing triggers. Version 3.14.3 of the Packagist package 'digitalelvis/neuronai-studio' is malicious, and researchers advise treating any machine that installed it as compromised. Two versions of the Go module 'github.com/onuragtas/docker-env' (v1.0.278 and v1.0.280) also contain the stealer in workflow files.

The stealer was also found in 28 WebdriverIO repositories through commits attributed to the bot account 'wdio-bot.' While no package releases were affected, the bot's token should be considered stolen. The researchers note that the attacker appears focused on CI secrets rather than spreading through packages.

Connection to Previous Attacks

The accounts used in this week's attack overlap with those compromised during GhostAction's October wave, where stolen GitHub accounts pushed similar secret-stealing workflows. Accounts hit in October were approximately 1,000 times more likely than other active accounts to be used this week. In more than 100 repositories, the new stealer was added to October's existing workflow files.

Aikido Security has not attributed November's attacks to the same actor as October's, citing differences in infrastructure, tools, and methods. The company notes that stolen credentials often end up with multiple attackers over time.