WFX Phantom: The GitHub Actions Secret Stealer That Deletes Its Tracks

A coordinated attack campaign dubbed 'WFX Phantom' has compromised GitHub accounts using stolen tokens to inject a malicious shell script, named 'wfx', into repositories via pull requests and direct commits. The script is executed through GitHub Actions to steal secrets, cloud credentials, and runner memory, then exfiltrates the data using Telegram or HTTP to attacker-controlled servers. The attackers rapidly revert their changes and delete workflow runs to erase evidence, making detection difficult. The campaign has affected thousands of repositories, leveraging automation accounts and third-party app tokens, including those from the Fly.io GitHub App, to propagate across projects.

AI-extracted · verify before operational use