{"id":2210,"date":"2026-11-13T07:19:04","date_gmt":"2026-11-13T00:19:04","guid":{"rendered":"https:\/\/vncybers.vn\/wfx-loot-xam-nhap-4837-tai-khoan-github-danh-cap-khoa-dam-may\/"},"modified":"2026-11-13T07:19:04","modified_gmt":"2026-11-13T00:19:04","slug":"wfx-loot-compromises-4837-github-accounts-steal-cloud-keys-2","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/wfx-loot-xam-nhap-4837-tai-khoan-github-danh-cap-khoa-dam-may\/","title":{"rendered":"wfx-loot Campaign Compromises 4,837 GitHub Accounts to Steal Cloud Keys"},"content":{"rendered":"

Chi\u1ebfn d\u1ecbch wfx-loot<\/strong> \u0111\u00e3 s\u1eed d\u1ee5ng th\u00f4ng tin x\u00e1c th\u1ef1c GitHub b\u1ecb \u0111\u00e1nh c\u1eafp \u0111\u1ec3 d\u00f2 quy\u1ec1n ghi tr\u00ean h\u01a1n 61.000 kho m\u00e3, c\u00e0i m\u00e3 \u0111\u1ed9c v\u00e0o quy tr\u00ecnh CI v\u00e0 thu th\u1eadp b\u00ed m\u1eadt truy c\u1eadp. B\u00e1o c\u00e1o c\u00f4ng b\u1ed1 ng\u00e0y 12\/11\/2026 cho th\u1ea5y \u0111\u00e2y l\u00e0 m\u1ed9t s\u1ef1 c\u1ed1 quy m\u00f4 l\u1edbn, \u0111\u1eb7t ra r\u1ee7i ro tr\u1ef1c ti\u1ebfp v\u1edbi GitHub Actions, h\u1ea1 t\u1ea7ng \u0111\u00e1m m\u00e2y v\u00e0 chu\u1ed7i cung \u1ee9ng ph\u1ea7n m\u1ec1m.<\/p>\n

\"Kho
Quy tr\u00ecnh CI\/CD tr\u1edf th\u00e0nh m\u1ee5c ti\u00eau \u0111\u00e1nh c\u1eafp kh\u00f3a truy c\u1eadp trong chi\u1ebfn d\u1ecbch wfx-loot. Ngu\u1ed3n \u1ea3nh: Aikido Security.<\/figcaption><\/figure>\n

wfx-loot l\u00e0 g\u00ec?<\/h2>\n

Aikido Security \u0111\u1eb7t t\u00ean chi\u1ebfn d\u1ecbch l\u00e0 wfx-loot d\u1ef1a tr\u00ean d\u1ea5u v\u1ebft trong m\u00e3 \u0111\u1ed9c v\u00e0 thu\u1eadt ng\u1eef m\u00e0 k\u1ebb t\u1ea5n c\u00f4ng d\u00f9ng cho d\u1eef li\u1ec7u \u0111\u00e1nh c\u1eafp. Ho\u1ea1t \u0111\u1ed9ng b\u1eaft \u0111\u1ea7u kho\u1ea3ng 12:45 UTC ng\u00e0y 10\/11\/2026, s\u1eed d\u1ee5ng th\u00f4ng tin x\u00e1c th\u1ef1c c\u1ee7a 4.837 t\u00e0i kho\u1ea3n GitHub \u0111\u1ec3 m\u1edf y\u00eau c\u1ea7u k\u00e9o th\u0103m d\u00f2 tr\u00ean 61.764 kho m\u00e3.<\/p>\n

\u00cdt nh\u1ea5t 1.835 m\u1ee5c ti\u00eau \u0111\u01b0\u1ee3c x\u00e1c nh\u1eadn \u0111\u00e3 l\u00e0m l\u1ed9 b\u00ed m\u1eadt. Kho\u1ea3ng 50 t\u00e0i kho\u1ea3n b\u1ecb x\u00e2m nh\u1eadp c\u00f2n c\u00f3 quy\u1ec1n ph\u00e1t h\u00e0nh g\u00f3i l\u00ean npm, PyPI, Go, crates v\u00e0 Packagist, khi\u1ebfn ph\u1ea1m vi r\u1ee7i ro v\u01b0\u1ee3t kh\u1ecfi t\u1eebng kho m\u00e3 ri\u00eang l\u1ebb.<\/p>\n

Chu\u1ed7i t\u1ea5n c\u00f4ng di\u1ec5n ra nh\u01b0 th\u1ebf n\u00e0o?<\/h2>\n

K\u1ebb t\u1ea5n c\u00f4ng tr\u01b0\u1edbc h\u1ebft t\u1ea1o nh\u00e1nh wfx-docs<\/code> v\u00e0 y\u00eau c\u1ea7u k\u00e9o mang ti\u00eau \u0111\u1ec1 docs: dependency audit notes<\/code> \u0111\u1ec3 x\u00e1c nh\u1eadn quy\u1ec1n ghi. Khi c\u00f3 \u0111\u1ee7 quy\u1ec1n, ch\u00fang s\u1eeda workflow hi\u1ec7n h\u1eefu, th\u00eam workflow tr\u00ean nh\u00e1nh t\u1ed3n t\u1ea1i ng\u1eafn ho\u1eb7c c\u00e0i hook postinstall<\/code> c\u1ee7a npm.<\/p>\n

Payload l\u00e0 m\u1ed9t shell script kho\u1ea3ng 1.500 d\u00f2ng. Sau khi ch\u1ea1y, m\u00e3 \u0111\u1ed9c nhanh ch\u00f3ng ho\u00e0n t\u00e1c thay \u0111\u1ed5i, x\u00f3a l\u1ecbch s\u1eed workflow v\u00e0 nh\u1eadt k\u00fd trong ch\u01b0a \u0111\u1ea7y m\u1ed9t ph\u00fat, khi\u1ebfn kho\u1ea3ng tr\u1ed1ng trong s\u1ed1 th\u1ee9 t\u1ef1 l\u1ea7n ch\u1ea1y \u0111\u00f4i khi l\u00e0 d\u1ea5u v\u1ebft hi\u1ebfm hoi c\u00f2n l\u1ea1i.<\/p>\n

Nh\u1eefng b\u00ed m\u1eadt n\u00e0o c\u00f3 th\u1ec3 b\u1ecb \u0111\u00e1nh c\u1eafp?<\/h2>\n

Danh s\u00e1ch m\u1ee5c ti\u00eau g\u1ed3m GitHub Actions secrets, GITHUB_TOKEN<\/code>, token OIDC, bi\u1ebfn m\u00f4i tr\u01b0\u1eddng, kh\u00f3a SSH v\u00e0 th\u00f4ng tin x\u00e1c th\u1ef1c c\u1ee7a AWS, Azure, Google Cloud, Docker, Kubernetes, Vault v\u00e0 Terraform. M\u00e3 \u0111\u1ed9c c\u00f2n t\u00ecm kh\u00f3a c\u1ee7a c\u00e1c d\u1ecbch v\u1ee5 AI v\u00e0 c\u00f4ng c\u1ee5 ph\u00e1t tri\u1ec3n nh\u01b0 OpenAI, Anthropic, Gemini, Hugging Face, Cursor v\u00e0 GitHub Copilot.<\/p>\n

Tr\u00ean runner t\u1ef1 qu\u1ea3n l\u00fd, payload c\u00f3 th\u1ec3 \u0111\u1ecdc th\u00f4ng tin x\u00e1c th\u1ef1c t\u1eeb d\u1ecbch v\u1ee5 metadata c\u1ee7a m\u00e1y \u1ea3o, b\u1ed9 nh\u1edb ti\u1ebfn tr\u00ecnh, l\u1ecbch s\u1eed shell, t\u1ec7p c\u1ea5u h\u00ecnh v\u00e0 c\u00e1c commit g\u1ea7n \u0111\u00e2y. D\u1eef li\u1ec7u \u0111\u01b0\u1ee3c n\u00e9n r\u1ed3i g\u1eedi b\u1eb1ng HTTP POST t\u1edbi h\u1ea1 t\u1ea7ng do k\u1ebb t\u1ea5n c\u00f4ng ki\u1ec3m so\u00e1t.<\/p>\n

Nguy c\u01a1 leo thang tr\u00ean n\u1ec1n t\u1ea3ng \u0111\u00e1m m\u00e2y<\/h2>\n

wfx-loot kh\u00f4ng d\u1eebng \u1edf thu th\u1eadp kh\u00f3a. C\u00f4ng c\u1ee5 c\u00f3 th\u1ec3 \u0111\u1ed5i token OIDC th\u00e0nh phi\u00ean AWS, Azure ho\u1eb7c GCP; n\u1ed1i chu\u1ed7i vai tr\u00f2 IAM, m\u1ea1o danh t\u00e0i kho\u1ea3n d\u1ecbch v\u1ee5 v\u00e0 truy c\u1eadp kho b\u00ed m\u1eadt. Khi quy\u1ec1n cho ph\u00e9p, n\u00f3 c\u00f2n t\u1ea1o kh\u00f3a d\u00e0i h\u1ea1n ho\u1eb7c s\u1eeda ch\u00ednh s\u00e1ch tin c\u1eady \u0111\u1ec3 duy tr\u00ec truy c\u1eadp sau khi n\u1ea1n nh\u00e2n xoay v\u00f2ng token.<\/p>\n

\u1ea2nh h\u01b0\u1edfng t\u1edbi chu\u1ed7i cung \u1ee9ng ph\u1ea7n m\u1ec1m<\/h2>\n

C\u01a1 ch\u1ebf ph\u00e1t h\u00e0nh t\u1ef1 \u0111\u1ed9ng \u0111\u00e3 \u0111\u01b0a payload v\u00e0o g\u00f3i Packagist digitalelvis\/neuronai-studio<\/code> 3.14.3 v\u00e0 workflow c\u1ee7a hai phi\u00ean b\u1ea3n module Go github.com\/onuragtas\/docker-env<\/code>. Aikido \u0111\u00e1nh gi\u00e1 m\u1ee5c ti\u00eau ch\u00ednh v\u1eabn l\u00e0 b\u00ed m\u1eadt CI, nh\u01b0ng s\u1ef1 lan truy\u1ec1n ngo\u00e0i d\u1ef1 ki\u1ebfn cho th\u1ea5y m\u1ed9t t\u00e0i kho\u1ea3n nh\u00e0 ph\u00e1t tri\u1ec3n b\u1ecb chi\u1ebfm c\u00f3 th\u1ec3 k\u00e9o theo nhi\u1ec1u h\u1ec7 sinh th\u00e1i.<\/p>\n

D\u1ea5u hi\u1ec7u nh\u1eadn bi\u1ebft quan tr\u1ecdng<\/h2>\n
    \n
  • Nh\u00e1nh wfx-docs<\/code> ho\u1eb7c nh\u00e1nh d\u1ea1ng chore\/xxxxxxxx<\/code>.<\/li>\n
  • Y\u00eau c\u1ea7u k\u00e9o docs: dependency audit notes<\/code>.<\/li>\n
  • Commit nh\u01b0 ci: refresh build cache<\/code> ho\u1eb7c chore: add ci helper<\/code>.<\/li>\n
  • Kho\u1ea3ng tr\u1ed1ng b\u1ea5t th\u01b0\u1eddng trong s\u1ed1 th\u1ee9 t\u1ef1 workflow run.<\/li>\n
  • K\u1ebft n\u1ed1i t\u1edbi 194.150.166[.]244:8080<\/code> ho\u1eb7c 18.143.168[.]96:8080<\/code>.<\/li>\n<\/ul>\n

    T\u1ed5 ch\u1ee9c c\u1ea7n l\u00e0m g\u00ec ngay?<\/h2>\n

    Ch\u1ee7 kho m\u00e3 n\u00ean r\u00e0 so\u00e1t nh\u00e1nh, pull request, commit v\u00e0 l\u1ecbch s\u1eed workflow t\u1eeb ng\u00e0y 10\/11. N\u1ebfu payload t\u1eebng ch\u1ea1y, c\u1ea7n coi to\u00e0n b\u1ed9 b\u00ed m\u1eadt v\u00e0 vai tr\u00f2 \u0111\u00e1m m\u00e2y m\u00e0 workflow ti\u1ebfp c\u1eadn l\u00e0 \u0111\u00e3 b\u1ecb l\u1ed9, thu h\u1ed3i v\u00e0 xoay v\u00f2ng ch\u00fang, \u0111\u1ed3ng th\u1eddi ki\u1ec3m tra kh\u00f3a d\u00e0i h\u1ea1n, ch\u00ednh s\u00e1ch IAM v\u00e0 danh t\u00ednh li\u00ean k\u1ebft m\u1edbi t\u1ea1o.<\/p>\n

    V\u1ec1 d\u00e0i h\u1ea1n, t\u1ed5 ch\u1ee9c n\u00ean gi\u1edbi h\u1ea1n quy\u1ec1n m\u1eb7c \u0111\u1ecbnh c\u1ee7a workflow, t\u00e1ch runner theo m\u1ee9c \u0111\u1ed9 tin c\u1eady, b\u1ea3o v\u1ec7 nh\u00e1nh, y\u00eau c\u1ea7u ph\u00ea duy\u1ec7t thay \u0111\u1ed5i CI v\u00e0 gi\u00e1m s\u00e1t h\u00e0nh vi ph\u00e1t h\u00e0nh g\u00f3i. B\u00ed m\u1eadt ng\u1eafn h\u1ea1n v\u00e0 quy\u1ec1n t\u1ed1i thi\u1ec3u gi\u00fap gi\u1ea3m \u0111\u00e1ng k\u1ec3 ph\u1ea1m vi thi\u1ec7t h\u1ea1i khi t\u00e0i kho\u1ea3n nh\u00e0 ph\u00e1t tri\u1ec3n b\u1ecb chi\u1ebfm.<\/p>\n

    B\u00e0i h\u1ecdc t\u1eeb chi\u1ebfn d\u1ecbch wfx-loot<\/h2>\n

    S\u1ef1 c\u1ed1 cho th\u1ea5y t\u00e0i kho\u1ea3n GitHub v\u00e0 pipeline CI\/CD l\u00e0 m\u1ed9t ph\u1ea7n c\u1ee7a m\u1eb7t ph\u1eb3ng ki\u1ec3m so\u00e1t h\u1ea1 t\u1ea7ng, kh\u00f4ng ch\u1ec9 l\u00e0 c\u00f4ng c\u1ee5 ph\u00e1t tri\u1ec3n. M\u1ed9t token c\u00f3 quy\u1ec1n ghi c\u00f3 th\u1ec3 m\u1edf \u0111\u01b0\u1eddng t\u1eeb kho m\u00e3 \u0111\u1ebfn \u0111\u00e1m m\u00e2y, registry g\u00f3i v\u00e0 m\u00f4i tr\u01b0\u1eddng s\u1ea3n xu\u1ea5t; v\u00ec v\u1eady ki\u1ec3m so\u00e1t danh t\u00ednh, nh\u1eadt k\u00fd b\u1ea5t bi\u1ebfn v\u00e0 ph\u1ea3n \u1ee9ng xoay v\u00f2ng b\u00ed m\u1eadt ph\u1ea3i \u0111\u01b0\u1ee3c thi\u1ebft k\u1ebf nh\u01b0 n\u0103ng l\u1ef1c c\u1ed1t l\u00f5i.<\/p>\n

    VNCyberS<\/strong> t\u1ed5ng h\u1ee3p t\u1eeb Aikido Security v\u00e0 BleepingComputer<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

    Chi\u1ebfn d\u1ecbch wfx-loot \u0111\u00e3 s\u1eed d\u1ee5ng th\u00f4ng tin x\u00e1c th\u1ef1c GitHub b\u1ecb \u0111\u00e1nh c\u1eafp \u0111\u1ec3 d\u00f2 quy\u1ec1n ghi tr\u00ean h\u01a1n 61.000 kho m\u00e3, c\u00e0i m\u00e3 \u0111\u1ed9c v\u00e0o quy tr\u00ecnh CI v\u00e0 thu th\u1eadp b\u00ed m\u1eadt truy c\u1eadp. B\u00e1o c\u00e1o c\u00f4ng b\u1ed1 ng\u00e0y 12\/11\/2026 cho th\u1ea5y \u0111\u00e2y l\u00e0 m\u1ed9t s\u1ef1 c\u1ed1 quy m\u00f4 l\u1edbn, \u0111\u1eb7t ra […]<\/p>\n","protected":false},"author":2,"featured_media":2209,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1],"tags":[1119,89,566,754,1118,426,477,1117],"class_list":["post-2210","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tin-tuc","tag-aikido-security","tag-bao-mat-dam-may","tag-chuoi-cung-ung-phan-mem","tag-ci-cd","tag-danh-cap-thong-tin-xac-thuc","tag-github","tag-github-actions","tag-wfx-loot"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/2210","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=2210"}],"version-history":[{"count":0,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/2210\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/2209"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=2210"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=2210"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=2210"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}