Threat actors used 4,837 compromised GitHub accounts to open pull requests across 61,764 repositories
At least 1,835 repositories executed the payload and had credentials exfiltrated
Authentication tokens, AWS, Azure and Google Cloud credentials, and more, targeted
Cybercriminals were recently seen abusing multiple GitHub features to deploy infostealers and exfiltrate user’s cloud login credentials and other secrets. Tens of thousands of repositories have already been targeted, and almost 2,000 fell prey to the attack, cybersecurity researchers Aikido said, in a recent report outlining how the attackers used stolen GitHub credentials to abuse GitHub Actions and workflows, two features designed to speed up and automate certain activities. GitHub is a platform for developers working on open source projects. Each project has its own “repository” – a folder containing source code, configuration files, and other resources. Developers can propose changes to public repositories through a process called “pull request”, after which other developers can review and approve/decline the changes. GitHub also has an automation service called Actions, that allows developers to automatically execute various tasks, including pull requests. These automated processes are called workflows and can be described as a set of instructions telling GitHub what to do. Here is another vital nugget of information: workflows can access sensitive credentials when required to perform these tasks. Using compromised accounts
According to Aikido, the threat actors used 4,837 compromised GitHub accounts to open pull requests across 61,764 repositories. The researchers did not say how the attackers obtained these accounts, or how they were compromised. The pull requests were probes, not actual attacks, and were used so the attackers can see which projects they could modify. “We’re tracking this campaign as wfx-loot based on the threat actor’s name for the malware and the term used for stolen secrets,” Aikido said…