Thousands of GitHub repositories targeted in widespread attack — 4,800 accounts already compromised to steal cloud credentials
Aikido researchers found attackers abusing stolen GitHub accounts and automated workflows to steal valuable secrets.
Cybercriminals have targeted thousands of GitHub repositories in a widespread attack, compromising 4,837 GitHub accounts and stealing cloud credentials from at least 1,835 repositories. The threat actors used compromised accounts to open pull requests across 61,764 repositories, with the goal of deploying malicious scripts and exfiltrating sensitive data.
The attackers employed various methods to deploy the payload, including modifying existing GitHub Actions workflows, adding shell scripts triggered by npm installation hooks, or creating new workflow files on temporary branches. The malicious code searched for sensitive information such as authentication tokens, cloud credentials, API keys, and developer shell histories.
Once the attackers gained access, they attempted to expand their reach by exchanging stolen tokens for cloud sessions, spoofing service accounts, and creating new credentials. They also modified AWS and Azure configurations to maintain access even after victims rotated their compromised credentials. At least 1,835 repositories executed the payload, leading to the exfiltration of stolen credentials.
The attackers quickly covered their tracks by reverting changes and deleting workflow execution logs. Aikido, a cybersecurity research group, advises affected users to rotate all secrets and cloud credentials that their workflows can access, as the campaign may have impacted their software supply chain as well.
Written by urgent.news from TechRadar's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
