WFX Phantom: The GitHub Actions Secret Stealer That Deletes Its Tracks
WFX Phantom malware uses compromised GitHub accounts to steal secrets via GitHub Actions.
A botnet of compromised GitHub accounts is using stolen tokens to push a secret-stealing script named 'wfx' into repositories. The script collects GitHub Actions secrets, runner memory, and cloud credentials, attempting to maintain persistence. Attackers quickly revert commits and delete workflow runs to minimize traces, but new probes continue to appear.
AI summary of the linked source. Not reviewed by an editor. How this works
The lesson from this incident
Full lessonAttackers compromised GitHub accounts and used stolen authentication tokens to inject a malicious script ('wfx') into CI/CD workflows, targeting GitHub Actions secrets, runner memory, and cloud credentials. The root cause lies in insufficient access control over repository write permissions and secrets management within GitHub Actions environments. What makes this attack particularly dangerous is the deliberate anti-forensics behavior: attackers reverted malicious commits and deleted workflow run logs, making detection and incident reconstruction extremely difficult. This highlights how CI/CD pipelines have become high-value targets because they concentrate privileged credentials in automated, often less-scrutinized environments. Organizations that lack robust monitoring of workflow changes and secret access events are effectively blind to this class of attack.
What helps against this
How we list vendors
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — wfx