Thousands of GitHub repos hit with secret-stealing malware

Publisher excerpt From CSO Online

Researchers have uncovered a campaign in which hijacked GitHub accounts spread secret-stealing malware across thousands of repositories. The payload executed in at least 1,806 repos, exfiltrating CI/CD secrets and cloud credentials. Aikido Security, which detected and documented the campaign, said the attackers used the 4,837 compromised accounts to open probe pull requests in 61,764 repositories starting Nov. 10. Around 92% of those pull requests, titled “docs: dependency audit notes,” are still open, which suggests most project owners have not seen them. However, the probes on their own are benign and were performed only to check whether the hijacked accounts had write-access in those repos so that the attackers could follow up with commits that contained the malicious payload: a 1,500-line shell script that collects GitHub Actions secrets, cloud credentials, and API keys for AI services and developer tools. The payload was delivered using at least three methods: modification of existing GitHub Actions workflows, adding a postinstall hook in the package.json file that runs it on any npm install and creating a throw-away branch with a rogue Actions workflow to be run. “We’ve identified indications that the payload ran in at least 1,806 repositories, but this number may understate impact,” the Aikido researchers said in their report. “The run log was deleted in impacted repositories, meaning the threat actor has likely collected the credentials and covered its tracks.” The npm hook that slipped past GitHub GitHub’s safeguard against this kind of attack worked as designed for the payloads it could see. The platform has blunted recent workflow-injection campaigns by requiring explicit approval before the malicious workflows run, and GitGuardian found that all seven of the November payload runs still visible in workflow files sat in an action_required state and never started. “GitHub held the workflow forms, but an npm hook slipped past the hold and ran,” Gaetan Ferry, a security researcher at GitGuardian, said in an analysis. That’s because the npm hook did not change any workflow file. Instead, the attacker added a hidden script to the repository root and a single line in package.json, which runs on every npm install. The repository’s own unchanged workflows executed npm install as routine build hygiene. By Thursday the attacker had also changed their exfiltration method. The latest payload sends stolen data only to a Telegram chat, with the HTTP callback now pointing to a dead address. Blocking the previously published IP addresses no longer stops the latest versions. What the malware steals Once the script runs, it receives every repository and organization secret through a JSON dump of the workflow’s secrets object. It scans the memory of the runner process, which holds secrets in decrypted form, including ones the workflow never referenced, and collects credential files from well-known paths, shell histories, and API keys for AI se…

Excerpt only, shown with attribution. This content belongs to the original publisher and has not been independently verified by CyberSecurity.pk.