Introduction
GitHub repositories were targeted in a campaign dubbed 'wfx-loot' that used malicious workflows to steal GitHub Actions secrets and cloud credentials. Tens of thousands of repositories were probed for write access, with some compromised accounts belonging to Fortune 100 organizations and government entities.
Campaign Overview
The wfx-loot campaign began on November 10, when the attacker used stolen GitHub credentials from 4,837 compromised accounts to probe 61,764 repositories for write access. The threat actor opened pull requests disguised as dependency audit notes to deliver a 1,500-line credential-stealing shell script, which collected various types of secrets from repositories.
Types of Secrets Collected
The script collected the following data:
- GitHub Actions and variables, the workflow’s GITHUB_TOKEN, OIDC, and Actions runtime tokens.
- Cloud credentials for AWS, Azure, and Google Cloud, including credentials exposed through instance metadata on self-hosted runners.
- Developer and infrastructure credentials from Git, SSH, GPG, Docker, Kubernetes, npm, PyPI, Vault, and Terraform.
- AI service and developer-tool credentials for OpenAI, Anthropic, Gemini, Hugging Face, Cursor, and GitHub Copilot.
- Other sources of secrets include environment variables, private keystores, shell histories, process memory, repository files, and recent commits, and workflow artifacts.
Cloud Privilege Escalation
The script also supports cloud privilege escalation by exchanging GitHub OIDC tokens for temporary AWS, Azure, and GCP cloud sessions. In AWS, it can chain into additional IAM roles present in the repository to create long-lived credentials for IAM users. It also uses collected service-account credentials to impersonate identities in GCP.
Detection and Remediation
Repository owners are advised to look for the 'wfx-docs' branch, the probe pull request, and gaps in workflow run numbers. Where payload execution is confirmed, all secrets and cloud roles available to the affected workflows should be considered compromised and rotated immediately. Adaptive Security's AI agents can help uncover email threats that may have evaded existing defenses.
Related Campaigns
The wfx-loot campaign shares similarities with the 2025 GhostAction campaign, which also targeted open-source software ecosystems for credential theft and privilege escalation. The researchers believe the primary objective of the wfx-loot campaign was to steal CI secrets, while package releases were a byproduct of automated publishing.
Conclusion
GitHub repositories were probed for write access, and some compromised accounts belonged to Fortune 100 companies and government entities. The threat actor used malicious workflows to inject stolen data into open-source software ecosystems, including AWS, Azure, and Google Cloud. Repository owners are advised to look for specific indicators and rotate compromised secrets immediately to mitigate the risk of further damage.
Comments