An alarming breach has impacted over 60,000 GitHub repositories, as attackers have inserted credential-stealing code into thousands. This significant threat has been reported by several cybersecurity firms, raising concerns within the developer community.
Attack Details and Methodology
The attack, dubbed wfx-loot by Aikido Security, commenced on November 10. The firm identified around 4,800 compromised accounts responsible for probe pull requests targeting 61,764 repositories. These requests aimed to verify if the stolen access allowed alterations within the repositories.
According to StepSecurity, the pull requests themselves were not harmful, but they laid the groundwork for deploying malware where permissions and configurations permitted. Aikido Security detected the malware running in over 1,800 repositories, while SafeDep found malicious commits in 8,093 public repositories. It is important to note that these numbers do not reflect successful malware execution.
Exploitation Techniques and Implications
Contrary to exploiting a GitHub Actions bug, the attacker utilized valid tokens from developer and bot accounts. The malicious code was embedded in existing or new GitHub Actions workflows, shell scripts run by CI systems, and npm installation hooks, posing risks to developers installing dependencies during the attack.
The scripts sought GitHub tokens, repository secrets, cloud credentials, and AI service keys, with capabilities designed to broaden access and establish persistence on AWS and Azure platforms. The attacker often reversed code changes and erased workflow runs to hide their traces.
Security Measures and Recommendations
StepSecurity traced some probe pull requests to tokens issued via the Fly.io GitHub app but could not ascertain the token acquisition method, nor was there evidence of a breach in Fly.io’s infrastructure. Notably affected were a Packagist package and versions of two Go modules.
While there are resemblances to October’s GhostAction campaign, Aikido believes different actors were involved. They caution organizations to assume all accessible secrets were compromised if the malware executed, advising the revocation of compromised tokens, rotation of exposed secrets, and scrutiny for unauthorized cloud changes.
This incident underscores the importance of robust security measures and constant vigilance in protecting sensitive information within software development environments.
