Threat video1:00
wfx-loot GitHub Actions Secret Stealer: Detection & IOCs
wfx-loot plants stealer workflows in public repos using stolen GitHub credentials. 9 detection rules, 17 IOCs and a free Splunk SPL rule.
Read the full threat intel for wfx-loot GitHub Actions Secret Stealer: Detection & IOCs →
Chapters
- 0:00The hookA CI secret stealer reached 17,715 repositories.
- 0:06The storyA mass wave hit public repositories.
- 0:12Attack pathStolen credentials pushed the stealer in commits.
- 0:27AttributionNo threat actor is attributed.
- 0:32Indicators of compromise12 indicators to hunt: 4 IPs, 5 URLs and 3 paths.
- 0:38MITRE ATT&CK techniques15 ATT&CK techniques, from initial access to exfiltration.
- 0:43Remediation10 remediation steps are listed, 4 of them immediate.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00A CI secret stealer reached 17,715 repositories.
0:07A mass wave hit public repositories.
0:09Using stolen GitHub credentials.
0:13Stolen credentials pushed the stealer in commits.
0:15An npm hook fires during npm install.
0:19It runs in CI and dumps secrets.
0:21Loot leaves over Telegram and HTTP C2.
0:28No threat actor is attributed. Confidence: low.
0:3212 indicators to hunt: 4 IPs, 5 URLs and 3 paths.
0:3915 ATT&CK techniques, from initial access to exfiltration.
0:4410 remediation steps are listed, 4 of them immediate.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.