Hackers Turn Nearly 5,000 GitHub Accounts Into Supply Chain Attack Tools - eSecurity Planet
Hackers have compromised 4,837 GitHub accounts in a campaign called wfx-loot, affecting 61,764 repositories through malicious GitHub Actions workflows.
The attackers leveraged stolen developer credentials to probe repository permissions and introduce malicious GitHub Actions workflows designed to steal sensitive information. According to security researchers at Aikido, the campaign harvested GitHub access tokens, cloud credentials, and API keys for AI services, while also establishing persistence in compromised systems.
Attack Mechanism
Rather than compromising each repository individually, the attackers used stolen credentials from developers who already had access to multiple projects. This approach allowed them to scale their attack significantly. Aikido identified suspicious pull requests titled 'docs: dependency audit notes' as part of the attackers' reconnaissance efforts.
One stolen developer account can open the door to dozens of repositories. Hackers have apparently found a way to turn that access into a supply chain attack on a much larger scale.
Detection and Response
Aikido recommends developers and organizations check repositories they can write to, particularly for activity from Nov. 10. Indicators include specific pull requests, branches (wfx-docs, chore/[random characters], ci-check-[digits]), and commit messages (ci: refresh build cache, chore: add dependency audit workflow).
Researchers have identified a specific stealer script with hash 89695abb392d5cfd4972672961e644bb46baa98aa1ed7173c2a2816c762735cf. If malware executed, organizations should revoke affected tokens, inspect cloud configurations, and investigate self-hosted runners and developer machines.
Broader Implications
The attack highlights the persistent challenge of access management in cybersecurity. While the exact method of credential theft remains unclear, phishing, infostealer malware, and exposed tokens remain likely vectors. The campaign's substantial reach demonstrates how a single compromised account can create widespread security risks across multiple organizations and projects.
Related
