Researchers report wfx attacks on GitHub accounts, with distinct impact measures

Security researchers have reported the wfx campaign targeting automated software workflows through stolen GitHub credentials. The published account, repository and execution figures measure different things and should not be combined into a single victim total.

Aikido reports two execution figures

Aikido’s November 12 research identifies 4,837 compromised accounts probing 61,764 repositories. Its summary says at least 1,835 repositories experienced payload execution and credential exfiltration; the detailed discussion says at least 1,806. The report does not reconcile the difference, preventing a definitive count. Deleted workflow records also complicate assessment.

SafeDep’s 8,093 figure measures something different

SafeDep reports malicious commits in 8,093 repositories between November 10 at 12:46 UTC and November 12 at 04:36 UTC. This does not mean 8,093 accounts were compromised or every repository lost data. The researchers describe credential theft followed by reverted changes that can leave branches looking clean. Attempts to retain access in AWS and Azure mean rotating secrets alone may be insufficient. These are findings at the researchers’ observation times, not a claim about the campaign’s current status.

Security context for development teams

GitHub’s secure-use guidance recommends granting workflow credentials only the minimum necessary permissions. It also advises reviewing stored secrets, removing unnecessary ones, rotating exposed credentials and considering approval requirements for access to environment secrets. Automatic log redaction is not guaranteed in every situation. Incident assessment should not rely solely on the current files appearing clean.

This article reports research findings; it does not establish that GitHub’s underlying platform infrastructure was breached.

Dji Banner Inside Article - 728x90