[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fA3dTl6l-fVQ6J2TOPDDQ19FPA5c1E0A06KonSmXu25s":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"1cbb1e23-33d1-4637-b4b9-8ca4b210fd80","stolen-cicd-credentials-enable-mass-github-repository-compromise","5dc29633-1965-4dc4-85c6-724677a49504","Stolen CI\u002FCD Credentials Enable Mass GitHub Repository Compromise","The wfx-loot campaign exploited stolen credentials to access tens of thousands of GitHub repositories, executing malicious payloads in over 1,800 of them and exfiltrating GitHub Actions secrets and cloud credentials. The root issue is that CI\u002FCD pipeline secrets were overly permissive, long-lived, and insufficiently protected, making them high-value targets once initial access was gained. Injecting payloads into package repositories further amplifies the risk by potentially poisoning downstream software supply chains. This incident demonstrates how a single set of compromised credentials in a CI\u002FCD environment can cascade into widespread secret theft and software integrity compromise.","**Immediate actions:**\n- Rotate all GitHub Actions secrets and cloud credentials immediately if any exposure is suspected.\n- Audit all repositories for unexpected workflow changes, unauthorized commits, or injected Actions steps.\n- Revoke and replace any long-lived personal access tokens or service account credentials with short-lived, scoped alternatives.\n\n**Long-term improvements:**\n- Enforce the principle of least privilege for all GitHub Actions workflows, scoping secrets to only the repositories and jobs that require them.\n- Adopt OpenID Connect (OIDC) for cloud provider authentication in CI\u002FCD pipelines to eliminate the need for stored long-lived cloud credentials.\n- Implement branch protection rules and required code reviews to prevent unauthorized workflow modifications.\n\n**Detection measures:**\n- Enable GitHub audit log streaming and alert on anomalous secret access, unexpected workflow runs, or new Actions added to repositories.\n- Integrate secret scanning tools (e.g., GitHub Secret Scanning, Trufflehog) into pipelines to detect accidentally committed or injected credentials.\n- Monitor downstream package repositories for unexpected publish events or dependency changes originating from CI pipelines.",[12,13,14,15,16],"CIS Control 5: Account Management","NIST SP 800-53 IA-5: Authenticator Management","NIST CSF 2.0 PR.AA-05: Access permissions and authorizations","MITRE ATT&CK T1552.001: Credentials In Files","NIS2 Article 21(2)(i)",{"NIS2 Article 21(2)(i)":18,"CIS Control 5: Account Management":19,"MITRE ATT&CK T1552.001: Credentials In Files":20,"NIST SP 800-53 IA-5: Authenticator Management":21,"NIST CSF 2.0 PR.AA-05: Access permissions and authorizations":22},"This point covers access control and asset management, requiring organizations to protect credentials and manage access to critical systems like CI\u002FCD pipelines, directly relevant to the secret theft in this incident.","This control requires managing the lifecycle of credentials and enforcing least-privilege access; applying it would have limited the blast radius of the stolen credentials used to access repositories.","The attackers specifically targeted secrets stored within GitHub Actions workflows and repository configurations, which this technique describes.","IA-5 requires protecting and rotating authenticators such as tokens and secrets; enforcing short-lived credentials would have prevented the sustained exploitation seen in this campaign.","This category calls for managing access permissions so that credentials are scoped and revoked appropriately, which would have contained the damage from the stolen GitHub credentials.","published","2026-11-12T10:21:13.391307+00:00","2026-11-12T10:21:13.379+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F11\u002F12\u002Fwfx-loot-github-actions-secret-stealer\u002F","check-your-github-repos-a-secret-stealer-hit-tens-of-thousands-of-them-855e21","Check your GitHub repos: A secret stealer hit tens of thousands of them",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":38,"name":39,"slug":40,"description":41,"color":42},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",[],[45,49,53],{"slug":46,"name":47,"problem":48},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":50,"name":51,"problem":52},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",{"slug":54,"name":55,"problem":56},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped."]