Attackers Hijack GitHub Accounts to Scan 60,000+ Repositories, Steal Credentials from At Least 1,806

At a glance

Attackers used hijacked developer accounts to get into GitHub repositories and steal credentials used to build and deploy software. Security firm Endo Labs published a report on November 12. The attack, called wfx, was first seen on November 10, and how the first account was taken over is still unknown.

Key points

1. 1

   The attackers checked access rights across 61,764 repositories.

2. 2

   Traces of malicious code were found in 8,926 repositories.

3. 3

   Credentials were confirmed to have left at least 1,806 repositories.

4. 4

   The attackers planted malicious code in GitHub Actions, the automation tool that builds and tests code, to target cloud keys and package deployment tokens.

Why it matters

If a development team's keys and tokens are stolen, a company's cloud and deployment systems can be breached, so Korean development teams should check for signs of this attack.