Since Tuesday, a widespread campaign has compromised 4,837 GitHub accounts by injecting malicious code into at least 1,806 repositories.

The attack utilizes pull requests to deploy malware that harvests cloud provider credentials and CI secrets.

The software can also establish persistent access via federated credentials in Azure AD.

This report details the attack vector, the credentials at risk, and the necessary mitigation steps, including token rotation and the mandatory audit of recent pull requests.

How the attack is carried out

The perpetrators use the compromised accounts to submit code change proposals (pull requests) to third-party projects, using the title 'docs: dependency audit notes' and a specific branch called 'wfx-docs'.

If the suggestion is accepted, a malicious program is installed.…