The landscape of software development shifted dramatically when a coordinated wave of automated intrusions successfully weaponized the trust inherent in open-source collaboration platforms to harvest sensitive credentials at an unprecedented scale. Known as the wfx-loot campaign, this operation systematically leveraged approximately 5,000 compromised GitHub accounts to target more than 60,000 public repositories across the global ecosystem. Unlike traditional attacks that focus on a single vulnerability, this campaign utilized a broad-spectrum approach, combining credential stuffing with sophisticated automation to probe for write access. The primary objective remained the mass exfiltration of developer credentials, cloud service keys, and authentication tokens, which are the lifeblood of modern CI/CD pipelines. This operation highlighted a critical weakness in how developers manage repository permissions and secrets, forcing a widespread reevaluation of security protocols for automated workflows.
Tactics and Delivery: Probing for Weakness
The initial phase of the campaign relied on a highly structured multi-stage lifecycle that began with the automated probing of target repositories to determine permission levels. Attackers initiated thousands of pull requests, often exceeding 66,200 unique requests, specifically designed to bypass the suspicion of repository maintainers by using innocuous titles. By labeling these requests as “docs: dependency audit notes” and utilizing branches named “wfx-docs,” the malicious actors blended in with the routine maintenance tasks that characterize healthy open-source projects. If a pull request was successfully generated, it served as confirmation that the stolen account credentials possessed the necessary write access to modify the codebase. This distinction was vital because while over 60,000 repositories faced probing attempts, the malware successfully executed and exfiltrated data from a smaller subset of roughly 1,800 repositories that lacked sufficient security configurations.
Upon confirming access, the attackers deployed a comprehensive shell script consisting of approximately 1,500 lines of code tailored for deep reconnaissance and data harvesting. This payload was delivered through several mechanisms, including the direct modification of GitHub Actions workflow files and the embedding of malicious hooks within npm installation processes. By placing the code in npm hooks, the attackers ensured the script would trigger automatically during standard package installations, effectively hiding the malicious activity within the noise of daily development. A particularly devious tactic involved inserting the payload into existing shell scripts already present in a repository’s automated workflow. This allowed the primary workflow YAML files to remain unchanged, effectively evading security tools that only monitor configuration changes. The script targeted a massive range of data, from environment files to specific API keys for AI services like OpenAI and Google Gemini.
Vulnerability Analysis: The Fly.io Connection
A pivotal moment in the investigation occurred when a security disclosure regarding Fly.io revealed how many of the initial credentials were likely harvested before the main campaign. The vulnerability involved a deployment process where a GitHub access token was inadvertently left in the configuration file located within build directories. Because some customer applications included these directories in their publicly accessible images, the attackers were able to scrape these tokens and use them as the primary fuel for the wfx-loot campaign. This exposure provided the initial foothold required to launch the wider assault on thousands of other repositories, demonstrating how a single oversight in image hygiene can lead to a cascading supply chain failure. Although the internal systems of the service provider were not breached, the leakage of these tokens allowed the malicious actors to simulate legitimate user activity, making it extremely difficult for automated systems to detect the intrusion early.
The campaign also demonstrated a remarkable ability to adapt its infrastructure in response to the active efforts of security researchers who identified the threat. Initially, the stolen data was exfiltrated to a cluster of external collection servers, but as defenders began blocking these specific IP addresses, the attackers quickly pivoted to more resilient methods. By early November, new variants of the malware began using Telegram bots for data exfiltration, leveraging the encrypted communication platform to bypass standard network filtering. Using a legitimate service for data transfer allowed the malicious traffic to blend in with standard enterprise communications, complicating the task for network security teams who could not block the platform without disrupting business operations. This shift in exfiltration tactics proved the attackers were not only automated but were also actively monitoring the defensive response to maintain their operational continuity and maximize the value of the stolen data.
Cloud Infrastructure: Escalation and Persistence
The wfx-loot script was engineered for more than just simple data theft; it contained advanced logic designed to facilitate lateral movement and long-term persistence within cloud environments. By leveraging GitHub’s OpenID Connect (OIDC) authentication, the script attempted to pivot from the compromised repository directly into connected cloud accounts on AWS, Azure, and Google Cloud Platform. Once inside, the script could request new cloud sessions and create permanent access keys that functioned independently of the original GitHub compromise. This meant that even if a developer deleted the malicious code from their repository, the attackers might still maintain a backdoor into the organization’s cloud infrastructure. The ability to generate federated identity credentials ensured that the attackers could impersonate legitimate services, allowing them to move horizontally through the network and access sensitive databases or internal tools that were previously isolated from the public repository.
The impact of this persistence strategy was felt across several high-profile projects, including repositories for Nextcloud and WebdriverIO, where malicious commits were successfully identified. In some cases, the attackers successfully executed the stealer within a workflow, though project maintainers were often quick to intervene before public package releases were corrupted. Beyond simple code modification, the script attempted to modify AWS role trust policies to allow unauthorized access from external accounts, a move that could grant attackers permanent administrative control. For Azure environments, the malware sought to add federated identity credentials to applications, creating a silent entry point for future exploitation. This focus on identity management and trust relationships marked a significant escalation from traditional supply chain attacks, which usually focus on the delivery of a payload rather than the subversion of the underlying cloud identity architecture.
Strategic Remediation: Securing the Pipeline
Recovering from a wfx-loot intrusion requires a meticulous audit of all repository activity to identify and neutralize any remnants of the malicious scripts. Organizations were advised to search for specific artifacts, such as branches named “wfx-docs” or any pull requests containing the phrase “dependency audit notes” that appeared during the peak of the campaign. A significant challenge in this audit process was the attackers’ practice of deleting workflow runs and execution logs immediately after the data had been successfully exfiltrated. Consequently, security teams had to treat any unexplained gaps in the CI/CD history as high-probability indicators of a successful compromise, even if no malicious code was currently visible in the repository. This necessitated a shift from looking for active malware to performing forensic analysis on missing data and metadata, as the absence of logs often told a more compelling story of the breach than the presence of modified files.
The resolution of the wfx-loot incident demanded a total rotation of all secrets and credentials that were ever exposed to the compromised workflows during the attack window. Security professionals insisted that simple deletion of the malicious branch or the removal of the shell script was insufficient to guarantee safety, as the tokens were likely harvested within seconds of execution. All exposed SSH keys, GPG keys, and API tokens were systematically revoked and replaced with new, more restricted credentials. Furthermore, cloud administrators were tasked with inspecting identity providers for unauthorized modifications to trust relationships and the creation of rogue access keys. This experience underscored the urgent need for implementing the principle of least privilege for all CI/CD tokens, ensuring that automated processes only have the specific permissions required for their tasks. The campaign served as a stark reminder that the security of the software supply chain is only as strong as its weakest authentication link.
