Rotating security credentials may not stop the “wfx-loot” malware currently infiltrating software build pipelines, as the stealer modifies AWS trust policies and adds Azure federated credentials to maintain permanent access. Starting Nov 10, hackers used 4,837 hijacked GitHub accounts to plant a credential-harvesting payload in 61,764 repositories, though the malware only successfully executed in at least 1,800 of them.
The stealer targets OIDC and GitHub Actions secrets and API keys for services including OpenAI and Anthropic, typically deleting workflow logs and reverting commits within a minute of execution to conceal its presence. Aikido advised organizations to search for pull requests titled “docs: dependency audit notes” or branches named “wfx-docs” to identify potential compromises. While the attack overlap with targets from October’s GhostAction campaign, researchers believe the two operations were carried out by different actors.
