[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fB8DAvWVpo6_e-_KnHg779XfDoMBsxSloBrken2qrNXM":3},{"article":4,"iocs":49,"watch_terms":53,"solutions":54,"lesson":144},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"98947af0-b163-4057-a888-3960222bce41","WFX Phantom: The GitHub Actions Secret Stealer That Deletes Its Tracks","wfx-phantom-the-github-actions-secret-stealer-that-deletes-its-tracks-88ff9b","A coordinated botnet of compromised GitHub accounts launched a widespread attack, opening seemingly harmless pull requests before pushing a malicious shell script directly to default branches. The script, dubbed **wfx**, executed through GitHub Actions to steal secrets before the attackers quickly reverted their changes, leaving minimal traces.","A botnet of compromised GitHub accounts is using stolen tokens to push a secret-stealing script named 'wfx' into repositories. The script collects GitHub Actions secrets, runner memory, and cloud credentials, attempting to maintain persistence. Attackers quickly revert commits and delete workflow runs to minimize traces, but new probes continue to appear.","WFX Phantom malware uses compromised GitHub accounts to steal secrets via GitHub Actions.","https:\u002F\u002Fwww.stepsecurity.io\u002Fblog\u002Fwfx-phantom-the-github-actions-secret-stealer","https:\u002F\u002Fcdn.prod.website-files.com\u002F673b71f0790aabf30bd30bf8\u002F6af566c804a4ab1184d3df63_image%20(4).png","2026-11-12T07:58:30+00:00","2026-11-12T08:00:39.937958+00:00",8,[17,20,22,24],{"name":18,"type":19},"GitHub Actions","technology",{"name":21,"type":19},"AWS",{"name":23,"type":19},"Azure",{"name":25,"type":19},"Telegram","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":26,"icon":28,"name":29,"slug":30},null,"Malware","malware",[32,37,42,44],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":38},{"id":39,"icon":28,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":26,"icon":28,"name":29,"slug":30},{"category":45},{"id":46,"icon":28,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50],{"type":30,"value":51,"context":52},"wfx","Name of the secret-stealing shell script.",[],{"controls":55,"vendors":140},[56,85,114],{"slug":57,"name":58,"problem":59,"products":60},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[61,69,77],{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"slug":86,"name":87,"problem":88,"products":89},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[90,98,106],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",{"slug":115,"name":116,"problem":117,"products":118},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[119,127,135],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":136,"product_name":137,"url":138,"description":139},"managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",[141],{"slug":91,"name":92,"logo_path":93,"roles":142},[143],"affected",{"slug":145,"title":146,"body":147,"framework_refs":148,"framework_notes":154},"github-actions-secret-stealer-exploits-stolen-tokens-and-covers-its-tracks","GitHub Actions Secret Stealer Exploits Stolen Tokens and Covers Its Tracks","Attackers compromised GitHub accounts and used stolen authentication tokens to inject a malicious script ('wfx') into CI\u002FCD workflows, targeting GitHub Actions secrets, runner memory, and cloud credentials. The root cause lies in insufficient access control over repository write permissions and secrets management within GitHub Actions environments. What makes this attack particularly dangerous is the deliberate anti-forensics behavior: attackers reverted malicious commits and deleted workflow run logs, making detection and incident reconstruction extremely difficult. This highlights how CI\u002FCD pipelines have become high-value targets because they concentrate privileged credentials in automated, often less-scrutinized environments. Organizations that lack robust monitoring of workflow changes and secret access events are effectively blind to this class of attack.",[149,150,151,152,153],"MITRE ATT&CK T1552.001: Credentials in Files","MITRE ATT&CK T1070: Indicator Removal","CIS Control 6: Access Control Management","NIST SP 800-53 AU-9: Protection of Audit Information","NIS2 Article 21(2)(i)",{"NIS2 Article 21(2)(i)":155,"MITRE ATT&CK T1070: Indicator Removal":156,"CIS Control 6: Access Control Management":157,"MITRE ATT&CK T1552.001: Credentials in Files":158,"NIST SP 800-53 AU-9: Protection of Audit Information":159},"The incident exploited weak access control over GitHub account credentials and repository permissions, which falls under this point's requirement for robust human resources security, access control, and asset management practices.","Attackers deliberately reverted malicious commits and deleted GitHub Actions workflow run logs to destroy forensic evidence, which is precisely what this technique describes.","Stolen tokens granted repository write access that enabled injection of malicious workflows; enforcing least-privilege access and token lifecycle management would have limited the blast radius of compromised accounts.","The wfx script explicitly targeted secrets stored in GitHub Actions environments and runner memory, matching this technique's focus on harvesting credentials from files and environment variables in automated systems.","Attackers deleted workflow run logs to erase evidence; this control requires that audit records be protected against deletion or modification, which would have preserved the forensic trail."]