A massive, coordinated cyberattack is sweeping GitHub. Attackers are using thousands of compromised accounts and have attempted to push secret-stealing code to more than 66,000 public repositories, some of which belong to Fortune 100 and other major organizations, security researchers warn.

Security firms are sounding the alarm over an automated, widespread attack on GitHub – a botnet of hijacked GitHub accounts is pushing malicious workflows to tens of thousands of repositories. Around 2,000 of them have already been compromised.

Attackers are using stolen valid tokens to inject a malicious shell script, called WFX, into GitHub Actions (CI/CD) workflows, which automatically run whenever developers submit code changes.

The malware harvests passwords, access keys, and other credentials, uses them to break into cloud accounts, creates backdoors for persistence, and sends stolen data back to the attackers.

All attacks start with a probe, which is a benign pull request titled ”dependency audit notes,” identical for every targeted repo.

“The pull request does nothing by itself. It tells the attacker that the token can write to the repository. If you see one, the account that opened it is compromised, even if nothing else happened,” warn the StepSecurity researchers in a threat intelligence report.

At the time of writing, there are already 66.500 such pull requests opened on GitHub, and new ones appear every minute.

The stealer injection follows the probe – the botnet pushes a workflow only to repositories where the hijacked tokens have sufficient permissions, and the repository setup allows it to run.

Huge scale

Aikido Security has discovered that, since Tuesday, the malicious workflow has run and exfiltrated credentials at least 1,970 confirmed times. This figure only includes publicly visible cases, and the actual number could be higher.

“Compromised accounts include users that belong to significant organizations within the Fortune 100, and users with access to repos belonging to Nextcloud, WebdriverIO, the US General Services Administration, and France’s beta.gouv.fr,” Aikido said in a comment.

The researchers clarify that compromised accounts had permission to push code to these organizations’ repositories, but this does not necessarily mean the malicious workflow ran there.

Private repositories are also affected, and companies should check for unexpected workflow files in .github/workflows/.

The attacks are ongoing, and the attackers are leveraging at least 4,800 compromised GitHub accounts to push secret-stealing workflows.

Around one-sixth of probing pull requests go to repositories that the account doesn’t own – the token holder has collaborator or organization access.

“92% of them are still open, which suggests most owners haven’t noticed,” Aikido said.

StepSecurity found that some of the stolen tokens used in the attacks were issued to the Fly.io GitHub App, which developers use to integrate their repositories with the hosting company.

“The attacker was using tokens that GitHub issues to the Fly.io app when a user connects their GitHub account to Fly.io, which let the app, and so the attacker, act as that user,” StepSecurity said.

StepSecurity found the malicious commits in repositories including nextcloud/docker, webdriverio/webdriverio, juejin-cn/repo-data, ipfs-shipyard/js-ipld-fixtures, and many more.

What is the stealer capable of?

The WFX stealer can be deployed in several ways: by editing an existing workflow (the most common), appending a script to an existing shell script used by the workflow, adding a new workflow, or adding a hidden helper script.

GitHub search returns over 28,000 commits with the message “ci: refresh build cache,” which attackers use to update the existing workflows.

For example, in the nextcloud/docker repo, the stealer was appended to update.sh, a script the repository's own workflow runs.

“As soon as the workflow starts, the attacker pushes a revert (ci: restore, sometimes followed by ci: cleanup) and deletes the workflow run with its logs,” StepSecurity warns.

WFX is a single shell script of about 1,500 lines.

It steals every credential it can find on the build machine: GitHub secrets and tokens, cloud and AI-service keys, including AWS, Azure, Google Cloud, OpenAI, Anthropic, shell histories, every .env, .pem, .p12, .jks, .kdbx, and kubeconfig file, and other credential files from well-known paths. It even copies the project's source code, the latest commits and recent workflow artifacts.

Then the payload uses stolen credentials to escalate the attack - get deeper cloud access.

“This malware isn’t just grabbing CI secrets but is built to pivot: minting cloud tokens, rewriting trust policies and creating federated access, so a leaked GitHub credential becomes a foothold in the victim’s cloud,” Aikido said.

The attack is so broad and indiscriminate that the malicious script has already been published in software packages, and dozens of compromised users appear to publish packages in other ecosystems.

The malware has three mechanisms for persistence and exfiltrates the collected data as a single gzipped archive.

The attackers are adapting their malware, and newer versions have begun sending stolen data through Telegram rather than attacker-controlled IPs.

Developers should look for signs of compromise, secure affected accounts, and revoke any stolen credentials or secrets. StepSecurity released detailed guidance in their advisory.