Attackers compromised 4,837 GitHub accounts to inject malicious scripts into thousands of repositories. According to Aikido Security, the script successfully executed in at least 1,806 repositories. SafeDep analysis identified 8,093 repositories that received malicious changes between Tuesday and November 12. The campaign began with a test pull request titled 'docs: dependency audit notes' from the wfx-docs branch, which appeared in 61,764 projects.
The malicious script was injected into 7,309 GitHub Actions workflows and 771 npm postinstall mechanisms. It targeted various credentials, including GitHub Actions secrets, GITHUB_TOKEN, OIDC tokens, and keys for AWS, Azure, Google Cloud, Kubernetes, npm, PyPI, and SSH. The script also exfiltrated repository contents, recent commits, and workflow artifacts, sending data to remote servers or Telegram.
The attackers utilized GitHub OIDC tokens to gain persistent access to AWS, Google Cloud, and Azure environments by modifying trust policies or adding federated credentials. These methods allowed for continued access even after initial tokens were revoked. Aikido Security noted that accounts affected by the October GhostAction attack were approximately 1,000 times more likely to be targeted in this new campaign, though no direct link between the two has been confirmed.
