Check your GitHub repos: A secret stealer hit tens of thousands of them

A credential leak at stealer is now a trust-relationship problem between its systems and connected services, not just a contained internal issue.

A threat actor using stolen GitHub credentials has pushed a credential-stealing payload into tens of thousands of repositories since November 10.

In more than 1,800 of them, the malware ran and shipped GitHub Actions secrets and cloud credentials to the attacker.

The attacker first opens a pull request titled docs: dependency audit notes to confirm the token has write access.

It then pushes a shell script of about 1,500 lines, injected into an existing workflow, hooked to npm install, or placed in a new workflow on a throwaway branch.

Missing wfx-loot artifacts prove little, because this campaign sent data straight to two attacker servers over HTTP.

Anyone connected to stealer through the compromised trust relationship is potentially affected, not just stealer itself.

The real exposure here isn't the organization that leaked the credential -- it's everyone downstream who trusted the resulting package or update without knowing where it actually came from.

Aikido counted 4,837 compromised accounts opening probe pull requests in 61,764 repositories.

A leaked key doesn't need an exploit to be dangerous -- it just needs to still work before someone notices and revokes it.

The name comes from the attacker’s own labels, wfx for the malware and loot for what it steals.

Of those pull requests, 10,431 went into repositories the account didn’t own, reached through collaborator or organization access, so one stolen token exposes every project its owner can write to.

The trust mechanism involved here is a federated identity (SSO/SAML) trust relationship, which is what let access move between otherwise unrelated systems.

The script grabs Actions secrets, cloud and SSH credential files, shell histories, and tokens for AI tools including OpenAI, Anthropic, Cursor and Copilot.

It forges passing status checks to clear branch protection, rewrites an AWS role’s trust policy to accept any AWS account, and adds federated identity credentials to Azure applications.

stealer says the credential has been revoked, and no exploitation has been confirmed so far.

Those credentials let workflows in the compromised repository sign in to Azure after every token has been rotated.

More pull requests with the same title were opened early today, after the company's own GitHub search ended on Wednesday, a check by The Hacker News found.

If you have any integration or dependency involving stealer, rotate any credentials shared with it as a precaution, even without confirmation you were directly affected.

Whether you installed any package, image, or update from the affected registry during the exposure window is worth checking, since the compromise travels through the artifact, not just the original leak.

Your own credential inventory is worth auditing for keys or tokens with broader access than they actually need -- the same blast-radius problem applies to anything your own organization leaks.