Malware Campaign Exploits GitHub Repositories to Steal AI and Cloud Credentials

A widespread malware campaign has targeted thousands of GitHub repositories, utilising hijacked accounts to exfiltrate cloud credentials, CI/CD secrets, and API keys for artificial intelligence services.

Researchers at Aikido Security identified that attackers used approximately 4,837 compromised GitHub accounts to conduct initial probes across 61,764 repositories. While many of these initial pull requests appeared benign, they were used to identify repositories where the hijacked accounts held write access. Once access was confirmed, the attackers deployed a 1,500-line shell script designed to harvest sensitive data.

Bypassing Workflow Protections

The attackers employed multiple delivery methods, including the modification of existing GitHub Actions workflows and the creation of rogue branches. However, a particularly effective method involved adding a postinstall hook to the package.json file. This allowed the malware to execute during routine npm install processes.

This specific technique allowed the payload to bypass GitHub’s recent security safeguards, which require explicit approval before new or modified workflows can run. Because the npm hook did not alter the workflow files themselves, the existing, approved workflows executed the malicious script as part of standard build procedures. Gaetan Ferry, a security researcher at GitGuardian, noted that while GitHub successfully held modified workflows in an action_required state, the npm hook slipped through these protections.

Deep Credential Theft and Persistence

Once executed, the script performs a JSON dump of the workflow’s secrets object. It also scans the memory of the runner process to capture decrypted secrets that may not have been explicitly referenced by the workflow. The malware targets a wide array of credentials, including:

• Cloud provider sessions for AWS, GCP, and Azure via OIDC token exchange.
• API keys for AI developer tools such as OpenAI, Anthropic, Copilot, and Cursor.
• Credential files from common system paths and shell histories.

To maintain access even after credentials are rotated, the malware implements several persistence mechanisms. In AWS environments, it can rewrite assumed role trust policies to accept any AWS account and create long-lived IAM access keys. In Azure, the script injects federated identity credentials, specifically named wfx-ci-*, into applications to allow continued authentication from the compromised repository.

Mitigation and Response

Security researchers advise that if a repository shows signs of a probe pull request or suspicious commit strings, all associated secrets should be considered compromised. Remediation steps include:

• Rotating all secrets: This includes repository and organisation secrets, package registry tokens, and all cloud-based keys.
• Auditing AWS: Inspect IAM user keys created since 10 November and review AWS role trust policies for unauthorised changes.
• Auditing Azure: Search for federated credentials named wfx-ci-* within applications.
• Enabling Audit Logs: Ensure full audit logging is active for cloud administrative behaviour to detect unauthorised persistence attempts.