Credential-Stealing GitHub Actions Workflows Discovered in Tens of Thousands of Repositories

A credential-stealing campaign has been identified that compromised the accounts of two prominent open-source maintainers to inject malicious GitHub Actions workflows into a large number of repositories. According to StepSecurity researchers, the threat actors used the account of Takashi Kitao, the author of the pyxel game engine project with over 18,400 stars, to push a malicious workflow to 27 repositories starting at approximately 13:20 UTC. In addition to the Kitao account, the attackers also compromised another high-profile maintainer account, extending the reach of the campaign to over 340 repositories in total.

The malicious workflows were designed to operate within the CI/CD pipeline, capturing credentials and secrets processed during workflow runs. The exact mechanism of exfiltration is not fully detailed in the initial report, but the presence of unauthorized workflows in repositories poses a significant risk to the confidentiality of tokens, API keys, and other sensitive data used in automated builds and deployments.

The attack is believed to be a supply-chain operation targeting the GitHub Actions ecosystem. By compromising trusted maintainer accounts, the actors were able to bypass some levels of trust and push code directly into repositories. The campaign highlights the need for maintainers and organizations to enforce strict access controls, enable two-factor authentication, and regularly audit the workflows present in their repositories.