Attacker Tests Stolen Access to 61,764 GitHub Repositories in Credential-Theft Campaign

An attacker tested stolen access to more than 60,000 GitHub repositories and inserted malicious code in thousands of them, according to Aikido Security, StepSecurity and SafeDep. Aikido said the campaign, which it calls wfx-loot, began on Nov. 10 and used roughly 4,800 compromised developer and bot accounts to submit probe pull requests to 61,764 repositories. The requests checked whether the stolen tokens allowed repository changes. StepSecurity said the pull requests did nothing by themselves; malware was later deployed where permissions and configuration allowed it.

The evidence trail points to abuse of valid tokens rather than a platform vulnerability. StepSecurity said the attacker did not exploit a bug in GitHub Actions and instead relied on tokens belonging to developer and bot accounts. The malicious code was placed in existing or new GitHub Actions workflows, shell scripts run by CI systems and npm installation hooks. Aikido found signs the stealer ran in more than 1,800 repositories, while SafeDep counted 8,093 public repositories that received malicious commits, a figure that does not prove successful execution.

The campaign's method mirrors developer supply-chain abuse: once a token or hook is active, the script can harvest GitHub tokens, repository secrets, cloud credentials and AI service keys, read GitHub Actions runner process memory and try to expand access and establish persistence in AWS and Azure. StepSecurity traced 173 probe pull requests to tokens issued to the Fly.io GitHub app but said it could not determine how the tokens were obtained and had no evidence Fly.io infrastructure was breached. Aikido noted similarities to October's GhostAction campaign but assessed the operations probably involved different actors.

This matters because GitHub repositories, CI runners and package installs are trusted paths into source code and cloud environments. The npm installation hook puts developers at risk while installing dependencies if malicious changes are present. Affected software releases include a Packagist package and versions of two Go modules. Aikido warned organizations should assume all accessible secrets were compromised if the malware executed, and advised revoking compromised tokens, rotating exposed secrets and checking for unauthorized cloud changes.