Massive GitHub Cyberattack Targets Over 66,000 Repositories to Steal Passwords and Access Keys

Hackers launched a massive cyberattack on GitHub, using thousands of compromised accounts to spread malware across more than 66,000 public repositories. Researchers have already confirmed around 2,000 cases of malicious code execution designed to steal passwords, access tokens, and developers’ sensitive data.

According to StepSecurity and Aikido Security, attackers are using at least 4,800 compromised GitHub accounts and stolen tokens with valid access permissions. Using these credentials, hackers modify automated GitHub Actions workflows by injecting a malicious script called WFX, which executes during software builds or updates. The affected repositories include projects associated with Fortune 100 companies, Nextcloud, WebdriverIO, the US General Services Administration, and the French government platform beta.gouv.fr.

The attack begins with a seemingly harmless pull request titled docs: dependency audit notes. The request itself contains no malicious code but allows attackers to check whether a stolen token has permission to modify the repository. If sufficient access is available, the hackers inject WFX into an existing GitHub Actions workflow or create a new one. As StepSecurity researchers explained, the appearance of such a pull request already indicates that the account used to create it has been compromised.

At the time of publication, a GitHub search showed approximately 66,500 similar pull requests, with new ones appearing every minute. According to Aikido Security, the malicious code had already executed in at least 1,970 publicly confirmed cases involving credential theft. The actual number may be higher, as the attack also affected private repositories. Approximately 92% of the probing pull requests remained open, suggesting that most repository owners may not have noticed the suspicious activity.

How WFX Malware Works

WFX is a shell script of approximately 1,500 lines designed to steal virtually every accessible secret from software build environments. It collects GitHub tokens, passwords, AWS, Azure, Google Cloud, OpenAI, and Anthropic keys, shell command histories, .env, .pem, .p12, .jks, and .kdbx files, Kubernetes configurations, and other credentials. The malware also copies project source code, recent commits, and artifacts from previous GitHub Actions runs.

Attackers use the stolen data to gain further access to cloud infrastructure. In particular, WFX can create new access tokens, modify AWS trust policies, and configure federated access in Azure, allowing attackers to maintain control over compromised systems even after stolen keys have been replaced.

To conceal the attack, hackers typically modify existing workflows or inject malicious code into legitimate shell scripts. Researchers discovered more than 28,000 commits on GitHub with the message ci: refresh build cache. For example, in the nextcloud/docker repository, WFX was added to the update.sh file, which runs automatically during workflow execution.

Once the malicious code executes, the attackers revert their changes and delete the workflow run history along with its logs. They use commits labeled ci: restore and ci: cleanup, making it harder for repository owners to detect the intrusion. Researchers also discovered that some of the stolen tokens had been issued to the Fly.io GitHub App, which enables integration between GitHub and the Fly.io hosting platform.

Initially, the stolen data was sent to servers controlled by the attackers, but newer versions of WFX began using Telegram. All collected information is packaged into a single compressed archive and transmitted through bots, making it more difficult to block the attack using known IP addresses.

The campaign has already spread beyond GitHub. Researchers found that the malicious code had made its way into certain published software packages, while dozens of compromised developers have access to other software distribution ecosystems. However, the presence of an affected repository among a major organization’s projects does not necessarily mean that the malicious workflow was executed there.

The attack is ongoing, prompting security experts to urge developers to inspect files in the .github/workflows/ directory, review suspicious commits, and examine their GitHub Actions history. If a compromise is detected, developers should secure their accounts and revoke all potentially stolen tokens and access keys. StepSecurity has published detailed recommendations for checking repositories.