A large-scale attack campaign known as "wfx-loot" has begun targeting the GitHub platform, where attackers have targeted over 60,000 repositories to test stolen access and plant malware aimed at stealing sensitive credentials. According to reports from security firms such as Aikido Security and StepSecurity, approximately 4,800 compromised accounts have been identified, which were used to submit suspicious Pull Requests to test available permissions.
The reports clarified that the malware successfully operated within more than 1,800 repositories where settings and permissions allowed it, while SafeDep recorded malicious modifications reaching approximately 8,093 public repositories, which does not necessarily mean the malware was successfully executed in all of them.
Attack mechanism: Exploiting trust, not vulnerabilities
A key point in this attack is that the attackers are not exploiting a software vulnerability in GitHub Actions, but instead rely on using valid access tokens belonging to developers or bot accounts that were previously compromised. The malware has been injected into several locations, including:
- GitHub Actions workflows.
- Shell scripts executed by Continuous Integration (CI) systems.
- npm package installation hooks, which poses a risk to developers who install dependencies while the malicious modifications are present.
What does this attack actually change?
The danger of the "wfx-loot" campaign lies in the shift of the attackers' strategy from searching for technical exploits to exploiting the "granted trust" of compromised accounts. Instead of trying to break the system, the attacker uses legitimate keys to perform illegitimate actions, making detection much more difficult. The malware targets the theft of GitHub tokens, repository secrets, and cloud credentials such as AWS and Azure, in addition to AI service keys, which could lead to a full compromise of organizational cloud infrastructure and expand the scope of access.
To hide their tracks, the attackers follow a method based on reverting code changes and deleting workflow run logs after completing the task. The use of tokens issued by the Fly.io application has also been observed in some requests, although there is no evidence yet of a breach of Fly.io's own infrastructure.
Security recommendations for developers and organizations
Given the severity of the situation, security firms advise organizations that may have been exposed to the malware execution to take immediate measures, including:
- Revoking all access tokens suspected of being compromised.
- Rotating all secrets and credentials that may have been exposed.
- Carefully reviewing cloud computing logs for any unauthorized changes or activities.