Two independent security teams, Aikido Security and SafeDep, have recorded a massive campaign targeting the theft of cloud and infrastructure credentials through the GitHub ecosystem. According to Aikido, the attacker used credentials from 4,837 hacked accounts to inject a malicious script into repositories accessible to those users for write operations. The company estimates that the script executed in at least 1,806 repositories. A separate analysis by SafeDep identified 8,093 repositories that received malicious changes between 12:46 UTC on Tuesday and 04:36 UTC on November 12. Importantly, this figure accounts for all detected repositories with malicious commits, not just those where the script actually executed. Furthermore, the scan covered only the primary branches of public projects, so the real scale of the incident, as acknowledged by the analysts, may be larger.
How the Attack Began: A Test Pull Request
The campaign started with reconnaissance: the attacker sent a test pull request titled "docs: dependency audit notes" from a branch called wfx-docs, checking whether a compromised account could actually change repository content. Similar requests appeared in 61,764 projects, after which some had a secret stealer added. SafeDep detected 7,309 instances of script injection into existing GitHub Actions workflows and another 771 instances where the malicious code spread via the npm postinstall mechanism—an automatic code execution feature during package installation. In the latter case, the script could run not only in the project's cloud infrastructure but also directly on the developer's computer. Typically, after the injection, the attacker reverted changes within minutes, and the execution logs were deleted along with the runs themselves, so the absence of visible attack traces does not mean data was not stolen.
What the Script Exfiltrated
The malicious code gathered virtually all available credentials: GitHub Actions secrets, GITHUB_TOKEN tokens, temporary OIDC and Actions Runtime tokens, AI service keys, and data from AWS, Azure, Google Cloud, Kubernetes, npm, PyPI, and SSH configuration files. Additionally, the script copied the repository content, the last 100 commits, and recent workflow artifacts. On self-hosted runners, it could obtain additional cloud credentials from virtual machine metadata, information about Docker containers, and systemd configurations. Stolen information was sent via HTTP POST to remote servers or to Telegram: upon checking 200 malicious commits, roughly 20% used Telegram exclusively.
Persistence in Cloud Infrastructure
Mechanisms for cloud persistence posed a particular danger. After obtaining GitHub OIDC tokens, the attacker could exchange them for access sessions to AWS, Google Cloud, and Azure, create permanent AWS keys, and modify cloud role trust policies. In Azure, they could add federated credentials with the wfx-ci- prefix, allowing workflows to authorize without a saved password. The key issue is that such mechanisms could continue to function even after revoking initial tokens and rotating keys, rendering standard response measures insufficient without a full audit of trust policies.
Connection to the GhostAction Attack
Aikido also detected an overlap with the GhostAction attack conducted in October: accounts affected then were roughly 1,000 times more likely to participate in the new campaign. However, the company does not yet link both attacks to the same attacker, as they utilized different tools and infrastructure. For affected organizations, this necessitates an immediate revocation of all tokens and keys, an audit of cloud role trust policies, verification of GitHub Actions workflows and npm dependencies, and monitoring for anomalous authorizations, including federated credentials with suspicious prefixes.
