[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fQFQ8nQGAyyQDdDrYOgQMW8Y4Y3pngNTfXXNQHDNHn9c":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"391865d9-8e54-4700-af95-e6c2bab1215b","github-actions-secret-stealer-exploits-stolen-tokens-and-covers-its-tracks","98947af0-b163-4057-a888-3960222bce41","GitHub Actions Secret Stealer Exploits Stolen Tokens and Covers Its Tracks","Attackers compromised GitHub accounts and used stolen authentication tokens to inject a malicious script ('wfx') into CI\u002FCD workflows, targeting GitHub Actions secrets, runner memory, and cloud credentials. The root cause lies in insufficient access control over repository write permissions and secrets management within GitHub Actions environments. What makes this attack particularly dangerous is the deliberate anti-forensics behavior: attackers reverted malicious commits and deleted workflow run logs, making detection and incident reconstruction extremely difficult. This highlights how CI\u002FCD pipelines have become high-value targets because they concentrate privileged credentials in automated, often less-scrutinized environments. Organizations that lack robust monitoring of workflow changes and secret access events are effectively blind to this class of attack.","**Immediate actions:**\n- Audit all GitHub repository collaborators and OAuth app permissions, revoking any tokens or access that cannot be verified as legitimate.\n- Rotate all GitHub Actions secrets and cloud credentials immediately, especially for repositories that have had recent unexpected workflow changes.\n- Enable GitHub's secret scanning and push protection features to detect and block credential exposure in real time.\n\n**Long-term improvements:**\n- Restrict GitHub Actions workflow permissions to the minimum required (e.g., read-only by default) and require code-owner approval before any workflow file changes are merged.\n- Store sensitive cloud credentials in a dedicated secrets manager (e.g., HashiCorp Vault, AWS Secrets Manager) with short-lived, scoped tokens rather than long-lived static secrets in Actions secrets.\n- Enforce multi-factor authentication on all GitHub accounts with write access to repositories containing CI\u002FCD workflows.\n\n**Detection measures:**\n- Set up alerting on GitHub audit log events for workflow file modifications, secret access, and workflow run deletions to catch anti-forensics activity quickly.\n- Integrate CI\u002FCD pipeline activity into your SIEM so that anomalous workflow executions or unexpected secret reads trigger immediate investigation.\n- Implement immutable, off-platform archiving of GitHub Actions workflow run logs so deletions by attackers do not eliminate your forensic record.",[12,13,14,15,16],"MITRE ATT&CK T1552.001: Credentials in Files","MITRE ATT&CK T1070: Indicator Removal","CIS Control 6: Access Control Management","NIST SP 800-53 AU-9: Protection of Audit Information","NIS2 Article 21(2)(i)",{"NIS2 Article 21(2)(i)":18,"MITRE ATT&CK T1070: Indicator Removal":19,"CIS Control 6: Access Control Management":20,"MITRE ATT&CK T1552.001: Credentials in Files":21,"NIST SP 800-53 AU-9: Protection of Audit Information":22},"The incident exploited weak access control over GitHub account credentials and repository permissions, which falls under this point's requirement for robust human resources security, access control, and asset management practices.","Attackers deliberately reverted malicious commits and deleted GitHub Actions workflow run logs to destroy forensic evidence, which is precisely what this technique describes.","Stolen tokens granted repository write access that enabled injection of malicious workflows; enforcing least-privilege access and token lifecycle management would have limited the blast radius of compromised accounts.","The wfx script explicitly targeted secrets stored in GitHub Actions environments and runner memory, matching this technique's focus on harvesting credentials from files and environment variables in automated systems.","Attackers deleted workflow run logs to erase evidence; this control requires that audit records be protected against deletion or modification, which would have preserved the forensic trail.","published","2026-11-12T08:20:22.052227+00:00","2026-11-12T08:20:22.031+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.stepsecurity.io\u002Fblog\u002Fwfx-phantom-the-github-actions-secret-stealer","wfx-phantom-the-github-actions-secret-stealer-that-deletes-its-tracks-88ff9b","WFX Phantom: The GitHub Actions Secret Stealer That Deletes Its Tracks",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":38,"name":39,"slug":40,"description":41,"color":42},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",[],[45,49,53],{"slug":46,"name":47,"problem":48},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":50,"name":51,"problem":52},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",{"slug":54,"name":55,"problem":56},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped."]