Overview
A stealer that arrives through a stolen account and is gone before anyone looks
What happened
Pushed with stolen tokens, reverted in seconds
Someone holding stolen GitHub tokens adds a credential stealer to a build workflow, an npm install hook or an existing shell script, and reverts the commit, within a minute wherever the revert was timed. Aikido, SafeDep and StepSecurity reported it on 12 November.
What Mate’s hunting agent found
A rehearsal, five versions and a replay
Mate’s hunting agent read the first commit carrying the stealer in every listed repository it could still reach. The stealer was rehearsed on GitHub from 25 October, has gone through five versions, and on 12 November was pushed again into most of the listed repositories. Most of the workflow files it landed in had been planted by earlier campaigns.
Why blocklists and missing-run checks mislead
No server left to block, and a missing run is not an execution
The current version sends to Telegram and names no server. A gap in a workflow’s run numbers shows only that a run record was removed: in most gaps Mate’s hunting agent examined, the run for the operator’s revert, seconds later, never started a job.
What you can do
Start from the account, then ask whether a job started
A pull request titled docs: dependency audit notes from a branch named wfx-docs means that account’s token is stolen: revoke it. Check the run for the revert commit, ci: restore: if it started a job, assume the stealer’s run did too and rotate everything the workflow could read. In AWS, look for sessions named ci- or wfx- and a number, and trust policies opened to any account; in Entra, credentials named wfx-ci-.
Key findings
Rehearsed in October, pushed from accounts earlier campaigns used, and a deleted run is not proof it ran
We read the stealer’s first commit in 8,070 of the 8,092 repositories SafeDep lists. It was rehearsed in 27 trial commits from 25 to 29 October, which tagged their uploads with six campaign tokens DISCOVERED BY MATE. Of the 7,225 workflow files it was added to, 5,191 had been planted by an earlier campaign, from the same account in every repository we checked (140 from GhostAction, 34 from Megalodon). On 12 November it was pushed again into 7,065 of the listed repositories. In a sample of 150 repositories, its run was missing in 115, yet in 82 of those the revert’s run never started a job.
Attack chain
From a stolen token to a reverted commit, in under a minute
The steps follow copies of the stealer we read from public commits between 25 October and 12 November. Nothing was run: what the stealer does in a cloud account is read from its text.
01Access
A stolen token, checked with a pull request
In repositories a stolen token can write to, the operator opens a pull request titled
docs: dependency audit notesfrom a branch namedwfx-docs. This probe alone means the token is stolen. How the tokens were taken is not established.- Pull request: docs: dependency audit notes
- Branch: wfx-docs
02aDelivery · Workflow
Steps added to an existing workflow
In 7,212 repositories,
ci: refresh build cacheadds two steps and the permissionstatuses: writeto a workflow that runs on a push: the alphabetically first one in 471 of 484 repositories we checked. In 16 more, a new workflow file is added instead.- ci: refresh build cache
- Pass runtime · Restore cache <4>
- .github/workflows/build-audit-<6>.yml
02bDelivery · npm
A hidden script that npm runs on every install
In 767 repositories,
chore: add ci helperadds a hidden.ci-<6>.shand apostinstallline inpackage.json. It runs wherevernpm installruns, including a developer’s machine, and it reached a published Packagist package.- chore: add ci helper
- .ci-<6>.sh
- digitalelvis/neuronai-studio 3.14.3, 3.14.4
02cDelivery · Shell scriptDISCOVERED BY MATE
Appended to a script the repository already had
In 74 repositories the stealer is appended to an existing shell script, after the line
# ci cache. It runs wherever that script runs.- ci: refresh build cache
- # ci cache
03Collection
Secrets, credential files and the runner’s memory
The stealer writes out the repository’s Actions secrets and job tokens, copies cloud, registry, SSH and AI-tool credential files, and searches the memory of the runner, the machine that runs the build, for tokens. It works in a directory named
.wfx-<pid>and deletes it at the end.- <temp>/.wfx-<pid>/
- <temp>/wfx-<pid>.tgz
- <temp>/wfx-scan-<pid>/
04Cloud access
From a build token to lasting access
The stealer trades GitHub identity tokens for cloud sessions. In AWS the first session is named
ci-<pid>; only a second role, assumed from the first, is namedwfx-<pid>. It then tries to create permanent access keys and opens that role’s trust policy to any account. In Microsoft Entra it adds a sign-in credential namedwfx-ci-<n>to applications. In 16 repositories it was also set to post a passing status under the repository’s required check names.- AWS session: ci-<pid>, then wfx-<pid>
- Trust policy: Principal AWS *
- Entra credential: wfx-ci-<n>
05Upload
One archive to a rented server, then to Telegram
The archive is posted over plain HTTP to port 8080 of a rented address (8081 in some trial copies), which changed with each wave. Since 01:46 UTC on 12 November copies send it to a Telegram chat instead. If nothing is delivered the stealer exits with code 42, which the npm form passes on to the install.
- 45.61.182[.]54
- 18.143.168[.]96
- 194.150.166[.]244
- 153.75.82[.]159
- Telegram chat -1004340163187
06Clean-up
Reverted in seconds, and the run record removed
A commit named
ci: restoreputs the workflow back, a median of 11 seconds later and never more than 58 in the 150 repositories we sampled;ci: cleanupremoves the hidden script. In 115 of the 150 the run for the stealer commit is no longer listed, which leaves a gap in the workflow’s run numbers.- ci: restore · ci: cleanup
- A missing run number
Detect & hunt
Detections and hunts
Ten detections to alert on and three hunts to run periodically, keyed on what has held across the copies we read rather than on servers. Endpoint cards cover six platforms plus Sigma; the others cover the platforms that document their logs, plus Sigma.
Detect: alert on these
10 detectionsFinds AssumeRoleWithWebIdentity calls through GitHub's OIDC provider, made with curl, with a session named ci-<digits>: the stealer's first step into AWS. Only the session it opens next, on another role, is named wfx-.
The session name and the curl call are unchanged in the trial copies of 25 to 29 October and all five November versions, in every copy we read to 12 November (08:08 UTC).
CloudTrail management events, read events included, from each account whose roles GitHub workflows assume, in a trail covering us-east-1, where CloudTrail records calls to STS's global endpoint.
Do not block: Do not block token.actions.githubusercontent.com, a GHE.com enterprise's token.actions.<subdomain>.ghe.com or sts.amazonaws.com: limit the role's trust policy to the repositories and branches that should assume it, and revoke its sessions.
#Vendor="aws" #event.module="cloudtrail"
| event.provider="sts.amazonaws.com" event.action="AssumeRoleWithWebIdentity"
| Vendor.requestParameters.roleSessionName=/^ci-[0-9]+$/
| user_agent.original=/^curl\//
| Vendor.userIdentity.identityProvider=/token[.]actions[.](?:githubusercontent[.]com|[a-z0-9-]+[.]ghe[.]com)(?:$|[^a-z0-9.-])/
or Vendor.responseElements.provider=/token[.]actions[.](?:githubusercontent[.]com|[a-z0-9-]+[.]ghe[.]com)(?:$|[^a-z0-9.-])/
| table([@timestamp, Vendor.recipientAccountId, error.code, Vendor.requestParameters.roleArn,
Vendor.requestParameters.roleSessionName, Vendor.userIdentity.userName, source.address,
user_agent.original], limit=1000, sortby=Vendor.requestParameters.roleArn, type=string, order=asc)
| head(1000)let GitHubIssuer = @"token[.]actions[.](?:githubusercontent[.]com|[a-z0-9-]+[.]ghe[.]com)(?:$|[^a-z0-9.-])";
AWSCloudTrail
| where TimeGenerated > ago(7d)
| where EventSource == "sts.amazonaws.com" and EventName == "AssumeRoleWithWebIdentity"
| where UserIdentityPrincipalid contains "token.actions." or ResponseElements contains "token.actions."
| where UserIdentityPrincipalid matches regex GitHubIssuer or ResponseElements matches regex GitHubIssuer
| extend Params = parse_json(RequestParameters)
| extend SessionName = tostring(Params.roleSessionName), RoleArn = tostring(Params.roleArn)
| where SessionName matches regex @"^ci-[0-9]+$"
| where UserAgent startswith "curl/"
| project TimeGenerated, RecipientAccountId, ErrorCode, RoleArn, SessionName,
Subject = UserIdentityUserName, SourceIpAddress, UserAgent
| sort by RoleArn asc, TimeGenerated asc
| take 500config timeframe = 7d
| dataset = amazon_aws_raw
| filter _log_type = "Cloud Audit Log" and eventSource = "sts.amazonaws.com"
and eventName = "AssumeRoleWithWebIdentity"
| alter session_name = requestParameters -> roleSessionName,
role_arn = requestParameters -> roleArn,
idp = userIdentity -> identityProvider,
provider = responseElements -> provider,
subject = userIdentity -> userName
| filter session_name ~= "(?-i)^ci-[0-9]+$" and userAgent ~= "^curl/"
and (idp ~= "token[.]actions[.](?:githubusercontent[.]com|[a-z0-9-]+[.]ghe[.]com)(?:$|[^a-z0-9.-])"
or provider ~= "token[.]actions[.](?:githubusercontent[.]com|[a-z0-9-]+[.]ghe[.]com)(?:$|[^a-z0-9.-])")
| fields _time, recipientAccountId, errorCode, role_arn, session_name, subject,
sourceIPAddress, userAgent
| sort asc role_arn, asc _time
| limit 1000index=* sourcetype=aws:cloudtrail earliest=-7d eventSource="sts.amazonaws.com" eventName=AssumeRoleWithWebIdentity "token.actions."
| where match('requestParameters.roleSessionName', "^ci-[0-9]+$") AND match(userAgent, "^curl/")
AND (match('userIdentity.identityProvider', "token[.]actions[.](githubusercontent[.]com|[a-z0-9-]+[.]ghe[.]com)($|[^a-z0-9.-])")
OR match('responseElements.provider', "token[.]actions[.](githubusercontent[.]com|[a-z0-9-]+[.]ghe[.]com)($|[^a-z0-9.-])")
OR match('userIdentity.principalId', "token[.]actions[.](githubusercontent[.]com|[a-z0-9-]+[.]ghe[.]com)($|[^a-z0-9.-])"))
| table _time recipientAccountId errorCode requestParameters.roleArn requestParameters.roleSessionName
userIdentity.userName sourceIPAddress userAgent
| sort 0 requestParameters.roleArn _time
| head 200FROM logs-aws.cloudtrail-*
| WHERE event.provider == "sts.amazonaws.com" AND event.action == "AssumeRoleWithWebIdentity"
AND aws.cloudtrail.user_identity.identity_provider RLIKE """.*token[.]actions[.](githubusercontent[.]com|[a-z0-9\-]+[.]ghe[.]com)([^a-z0-9.\-].*)?"""
AND aws.cloudtrail.request_parameters RLIKE """.*roleSessionName=ci-[0-9]+[,\}].*"""
AND user_agent.original LIKE "curl/*"
| KEEP @timestamp, cloud.account.id, event.outcome, aws.cloudtrail.error_code,
aws.cloudtrail.request_parameters, user.name, source.address, user_agent.original
| SORT @timestamp ASC
| LIMIT 1000title: AWS Role Assumed Through GitHub OIDC With curl and a ci-<digits> Session Name
id: 54f0537e-c625-40ee-b0f5-153a77d7e880
status: experimental
description: |
Detects AssumeRoleWithWebIdentity calls through GitHub's OIDC provider, made with curl,
whose role session is named ci- followed by digits. The wfx stealer, pushed into GitHub
repositories from October 2026, makes its first hop into AWS this way. AWS's
configure-aws-credentials action calls STS through the AWS SDK and names sessions
GitHubActions by default.
author: Mate Security
date: 2026-11-12
tags:
- attack.initial-access
- attack.lateral-movement
- attack.t1078.004
- attack.t1550.001
- detection.emerging-threats
logsource:
product: aws
service: cloudtrail
detection:
selection:
eventSource: sts.amazonaws.com
eventName: AssumeRoleWithWebIdentity
requestParameters.roleSessionName|re: '^ci-[0-9]+$'
userAgent|startswith: 'curl/'
selection_github_issuer:
- userIdentity.identityProvider|re: 'token[.]actions[.](githubusercontent[.]com|[a-z0-9-]+[.]ghe[.]com)($|[^a-z0-9.-])'
- responseElements.provider|re: 'token[.]actions[.](githubusercontent[.]com|[a-z0-9-]+[.]ghe[.]com)($|[^a-z0-9.-])'
condition: selection and selection_github_issuer
falsepositives:
- A pipeline that calls STS with curl and names its sessions ci- followed by a run or process number
level: highSee: Attack chain · Timeline
Finds the AssumeRole that opens a session named wfx-<digits> or tagged wfx, and every call made from a wfx- session: the stealer's session on a second role, from which it asks for IAM access keys and rewrites that role's trust policy.
The name is unchanged in every copy we read of all five November versions, to 12 November (08:08 UTC), and the tags are in all six copies we read in full; the October trial copies make no second role call.
CloudTrail management events, read and write, from every account and Region; a refused AssumeRole into another account is logged only in the calling account.
Do not block: Do not block sts.amazonaws.com: revoke the role's sessions, delete any key the session created and restore the trust policy.
#Vendor="aws" #event.module="cloudtrail"
| (event.provider="sts.amazonaws.com" event.action="AssumeRole"
(Vendor.requestParameters.roleSessionName=/^wfx-[0-9]+$/
or @rawstring=/"transitiveTagKeys"\s*:\s*\[[^\]]*"wfx"|"key"\s*:\s*"wfx"/))
or Vendor.userIdentity.arn=/:assumed-role\/[^\/]+\/wfx-[0-9]+$/
| table([@timestamp, Vendor.recipientAccountId, event.provider, event.action, error.code,
Vendor.userIdentity.arn, Vendor.requestParameters.roleSessionName, Vendor.requestParameters.roleArn,
source.address, user_agent.original], limit=500, sortby=@timestamp, order=asc)
| head(500)AWSCloudTrail
| where TimeGenerated > ago(7d)
| where (EventSource == "sts.amazonaws.com" and EventName == "AssumeRole" and RequestParameters contains "wfx")
or UserIdentityArn contains "/wfx-"
| extend Params = parse_json(RequestParameters)
| extend SessionName = tostring(Params.roleSessionName), RoleArn = tostring(Params.roleArn),
TagKeys = tostring(Params.transitiveTagKeys), Tags = tostring(Params.tags)
| where (EventName == "AssumeRole" and SessionName matches regex @"^wfx-[0-9]+$")
or (EventName == "AssumeRole" and (TagKeys matches regex @'"wfx"' or Tags matches regex @'"key"\s*:\s*"wfx"'))
or UserIdentityArn matches regex @":assumed-role/[^/]+/wfx-[0-9]+$"
| project TimeGenerated, RecipientAccountId, EventSource, EventName, ErrorCode, UserIdentityArn,
SessionName, RoleArn, SourceIpAddress, UserAgent, RequestParameters
| sort by TimeGenerated asc
| take 500config timeframe = 7d
| dataset = amazon_aws_raw
| filter _log_type = "Cloud Audit Log"
| alter session_name = requestParameters -> roleSessionName,
role_arn = requestParameters -> roleArn,
caller_arn = userIdentity -> arn
| filter (eventSource = "sts.amazonaws.com" and eventName = "AssumeRole"
and (session_name ~= "(?-i)^wfx-[0-9]+$"
or requestParameters ~= "(?-i)\x22transitiveTagKeys\x22\s*:\s*\[[^\]]*\x22wfx\x22|\x22key\x22\s*:\s*\x22wfx\x22"))
or caller_arn ~= "(?-i):assumed-role/[^/]+/wfx-[0-9]+$"
| fields _time, recipientAccountId, eventSource, eventName, errorCode, caller_arn, session_name,
role_arn, sourceIPAddress, userAgent
| sort asc _time
| limit 500index=* sourcetype=aws:cloudtrail earliest=-7d wfx
| where (eventSource="sts.amazonaws.com" AND eventName="AssumeRole"
AND (match('requestParameters.roleSessionName', "^wfx-[0-9]+$")
OR match(_raw, "\x22transitiveTagKeys\x22\s*:\s*\[[^\]]*\x22wfx\x22|\x22key\x22\s*:\s*\x22wfx\x22")))
OR match('userIdentity.arn', ":assumed-role/[^/]+/wfx-[0-9]+$")
| table _time recipientAccountId eventSource eventName errorCode userIdentity.arn
requestParameters.roleSessionName requestParameters.roleArn sourceIPAddress userAgent
| sort 0 _time
| head 200FROM logs-aws.cloudtrail-*
| WHERE (event.provider == "sts.amazonaws.com" AND event.action == "AssumeRole"
AND (aws.cloudtrail.request_parameters RLIKE """.*roleSessionName=wfx-[0-9]+[,\}].*"""
OR aws.cloudtrail.request_parameters RLIKE """.*(transitiveTagKeys=\[([^\]]*[ ,])?wfx[,\]]|\{key=wfx,).*"""))
OR aws.cloudtrail.user_identity.arn RLIKE """.*:assumed-role/[^/]+/wfx-[0-9]+"""
| KEEP @timestamp, cloud.account.id, event.provider, event.action, event.outcome,
aws.cloudtrail.error_code, aws.cloudtrail.user_identity.arn, aws.cloudtrail.request_parameters,
source.address, user_agent.original
| SORT @timestamp ASC
| LIMIT 500title: AWS Role Session Named or Tagged wfx (wfx Stealer Role Chain)
id: 49f8b597-74b9-4123-b7b2-7aee2d683788
status: experimental
description: |
Detects the AssumeRole call that opens an AWS role session named wfx- followed by digits
or tags a session with the key wfx, and any call made from a wfx- session. The wfx stealer, pushed into GitHub repositories
from November 2026, gives this name to the next role it assumes after exchanging a GitHub
Actions job's OIDC token for AWS credentials, then calls CreateAccessKey and
UpdateAssumeRolePolicy from that session (from its second version, ListUsers first).
author: Mate Security
date: 2026-11-12
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1078.004
- attack.t1098.001
- attack.t1098.003
- detection.emerging-threats
logsource:
product: aws
service: cloudtrail
detection:
selection_assume:
eventSource: sts.amazonaws.com
eventName: AssumeRole
requestParameters.roleSessionName|re: '^wfx-[0-9]+$'
selection_tagged:
eventSource: sts.amazonaws.com
eventName: AssumeRole
requestParameters.transitiveTagKeys: 'wfx'
selection_tag_key:
eventSource: sts.amazonaws.com
eventName: AssumeRole
requestParameters.tags.key: 'wfx'
selection_session:
userIdentity.arn|re: ':assumed-role/[^/]+/wfx-[0-9]+$'
condition: 1 of selection_*
falsepositives:
- A role session that a person or pipeline names wfx- followed by digits
level: criticalSee: Attack chain · Timeline
Finds a federated credential named wfx-ci-<number>, trusting GitHub's Actions issuer, on a Microsoft Entra application whose credentials changed: the add, and any later change until the credential is deleted. The stealer tries to add one to each of up to three applications it can list, so a workflow in the repository its copy was pushed into can sign in as them without a secret.
Unchanged in all five November versions we compared, to the latest copy compared (12 November, 08:08 UTC); the trial copies have no such step.
Entra ID audit logs; for CrowdStrike, with the original event text kept. The Splunk query reads sourcetype azure:monitor:aad, which the Event Hub input offers for Entra logs, not its generic default mscs:azure:eventhub.
Do not block: Do not block token.actions.githubusercontent.com or a GHE.com enterprise's token.actions.<subdomain>.ghe.com, which carry legitimate deployments to Azure: delete the credential, then review what the application's service principal did since it was added.
#repo="3pi_microsoft_entra_id"
| @rawstring=/FederatedIdentityCredentials/
| @rawstring=/"(?<operation>Update (application|service principal)[^"]*)"/i
// the new value must name GitHub's issuer and a wfx-ci credential
| @rawstring=/"newValue"\s*:\s*"(?:[^"\\]|\\.)*?token[.]actions[.](?:githubusercontent[.]com|[a-z0-9-]+[.]ghe[.]com)(?:$|[^a-z0-9.-])/
| @rawstring=/"newValue"\s*:\s*"(?:[^"\\]|\\.)*?(?<cred_name>wfx-ci-[0-9]+)/i
| @rawstring=/(?<wfx_cred>\{[^{}]*wfx-ci-[0-9]+[^{}]*\})/i
| regex("\"initiatedBy\"[^}]*?\"userPrincipalName\"[ ]*:[ ]*\"(?<actor_upn>[^\"]+)\"", strict=false)
| regex("\"initiatedBy\"[^}]*?\"app\"[ ]*:[ ]*[{][^}]*?\"displayName\"[ ]*:[ ]*\"(?<actor_app>[^\"]+)\"", strict=false)
| regex("\"correlationId\"[ ]*:[ ]*\"(?<correlation_id>[^\"]+)\"", strict=false)
| table([@timestamp, operation, cred_name, wfx_cred, actor_upn, actor_app, correlation_id, @id])
| head(200)// Microsoft Sentinel AuditLogs table (Entra ID audit logs)
let GitHubIssuer = @"token[.]actions[.](?:githubusercontent[.]com|[a-z0-9-]+[.]ghe[.]com)(?:$|[^a-z0-9.-])";
AuditLogs
| where TimeGenerated > ago(7d)
| where OperationName startswith "Update application" or OperationName =~ "Update service principal"
| mv-expand TargetResources
| mv-expand TargetResources.modifiedProperties
| where tostring(TargetResources_modifiedProperties.displayName) =~ "FederatedIdentityCredentials"
| extend NewCreds = tostring(TargetResources_modifiedProperties.newValue)
| where NewCreds matches regex @"(?i)wfx-ci-[0-9]+"
and NewCreds contains "token.actions."
and NewCreds matches regex GitHubIssuer
| extend WfxCred = extract(@"(?i)(\{[^{}]*wfx-ci-[0-9]+[^{}]*\})", 1, NewCreds)
| extend CredName = extract(@'(?i)"name"\s*:\s*"([^"]*)"', 1, WfxCred),
CredSubject = extract(@'(?i)"subject"\s*:\s*"([^"]*)"', 1, WfxCred),
ActorUser = tostring(InitiatedBy.user.userPrincipalName),
ActorApp = tostring(InitiatedBy.app.displayName),
ActorIp = tostring(InitiatedBy.user.ipAddress),
UserAgent = iif(tostring(AdditionalDetails[0].key) == "User-Agent", tostring(AdditionalDetails[0].value), ""),
AppName = tostring(TargetResources.displayName),
AppObjectId = tostring(TargetResources.id)
| project TimeGenerated, OperationName, Result, ActorUser, ActorApp, ActorIp, UserAgent,
AppName, AppObjectId, CredName, CredSubject, CorrelationId
| take 500config timeframe = 7d
| dataset = msft_azure_ad_audit_raw
| filter activityDisplayName ~= "^Update (application|service principal)"
and targetResources contains "FederatedIdentityCredentials"
and targetResources contains "token.actions."
// one row per target and modified property
| alter target_res = json_extract_array(targetResources, "$")
| arrayexpand target_res
| alter prop = json_extract_array(target_res, "$.modifiedProperties")
| arrayexpand prop
| alter prop_name = json_extract_scalar(prop, "$.displayName"),
new_creds = json_extract_scalar(prop, "$.newValue")
| filter prop_name = "FederatedIdentityCredentials"
// one row per credential in the new value, so a removed credential never matches
| alter cred = split(replace(replace(new_creds, "[{", ""), "}]", ""), "},{")
| arrayexpand cred
| filter cred ~= "(?i)wfx-ci-[0-9]+" and cred ~= "token[.]actions[.](?:githubusercontent[.]com|[a-z0-9-]+[.]ghe[.]com)(?:$|[^a-z0-9.-])"
| alter cred_json = concat("{", cred, "}")
| alter cred_name = coalesce(json_extract_scalar(cred_json, "$.Name"), json_extract_scalar(cred_json, "$.name")),
cred_subject = coalesce(json_extract_scalar(cred_json, "$.Subject"), json_extract_scalar(cred_json, "$.subject")),
app_name = json_extract_scalar(target_res, "$.displayName"),
app_object_id = json_extract_scalar(target_res, "$.id"),
actor_upn = initiatedBy -> user.userPrincipalName,
actor_app = initiatedBy -> app.displayName,
actor_ip = initiatedBy -> user.ipAddress
| fields _time, activityDisplayName, result, actor_upn, actor_app, actor_ip, app_name, app_object_id, cred_name, cred_subject, correlationId
| limit 1000index=* sourcetype="azure:monitor:aad" category=AuditLogs earliest=-7d
operationName IN ("Update application*", "Update service principal") wfx
properties.targetResources{}.modifiedProperties{}.displayName="FederatedIdentityCredentials"
| eval new_creds=mvjoin('properties.targetResources{}.modifiedProperties{}.newValue', " ")
| where match(new_creds, "(?i)wfx-ci-[0-9]+") AND match(new_creds, "token[.]actions[.](githubusercontent[.]com|[a-z0-9-]+[.]ghe[.]com)($|[^a-z0-9.-])")
| rex field=new_creds "(?<wfx_cred>\{[^{}]*(?i:wfx-ci-)[0-9]+[^{}]*\})"
| rex field=wfx_cred "(?i)\"name\"\s*:\s*\"(?<cred_name>[^\"]*)\""
| rex field=wfx_cred "(?i)\"subject\"\s*:\s*\"(?<cred_subject>[^\"]*)\""
| rename "properties.initiatedBy.user.userPrincipalName" AS actor_user,
"properties.initiatedBy.app.displayName" AS actor_app,
"properties.initiatedBy.user.ipAddress" AS actor_ip,
"properties.targetResources{}.displayName" AS app_name,
"properties.result" AS result, "properties.correlationId" AS correlation_id
| table _time operationName result actor_user actor_app actor_ip app_name cred_name cred_subject correlation_id
| head 200FROM logs-azure.auditlogs-*
| WHERE (event.action LIKE "Update application*" OR event.action == "Update service principal")
AND `azure.auditlogs.properties.target_resources.0.modified_properties.0.display_name` == "FederatedIdentityCredentials"
| EVAL new_creds = `azure.auditlogs.properties.target_resources.0.modified_properties.0.new_value`
| WHERE TO_LOWER(new_creds) RLIKE ".*wfx-ci-[0-9]+.*"
AND new_creds RLIKE """.*token[.]actions[.](githubusercontent[.]com|[a-z0-9\-]+[.]ghe[.]com)([^a-z0-9.\-].*)?"""
| GROK new_creds """(?<wfx_cred>\{[^{}]*(?i:wfx-ci-)[0-9]+[^{}]*\})"""
| GROK wfx_cred """(?i)"name"\s*:\s*"(?<cred_name>[^"]*)"""
| GROK wfx_cred """(?i)"subject"\s*:\s*"(?<cred_subject>[^"]*)"""
| KEEP @timestamp, event.action, event.outcome,
azure.auditlogs.properties.initiated_by.user.userPrincipalName,
azure.auditlogs.properties.initiated_by.app.displayName,
azure.auditlogs.properties.initiated_by.user.ipAddress,
`azure.auditlogs.properties.target_resources.0.display_name`,
`azure.auditlogs.properties.target_resources.0.id`,
cred_name, cred_subject, azure.auditlogs.properties.correlation_idtitle: Entra Federated Credential Named wfx-ci Added To An Application
id: bd0f489b-40f8-41f3-b47f-ccf41bf40166
status: experimental
description: |
Detects a federated identity credential named wfx-ci- plus a number, trusting GitHub's Actions
issuer, being written to a Microsoft Entra application. The wfx stealer tries to add one to each of
up to three applications its token can list, so a GitHub workflow in the repository its copy sits
in can sign in as the application without a secret.
author: Mate Security
date: 2026-11-12
tags:
- attack.persistence
- attack.privilege-escalation
- attack.t1098.001
- detection.emerging-threats
logsource:
product: azure
service: auditlogs
detection:
selection:
OperationName|startswith:
- 'Update application'
- 'Update service principal'
TargetResources.modifiedProperties.displayName: 'FederatedIdentityCredentials'
TargetResources.modifiedProperties.newValue|contains: 'wfx-ci-'
TargetResources.modifiedProperties.newValue|re: 'token[.]actions[.](githubusercontent[.]com|[a-z0-9-]+[.]ghe[.]com)($|[^a-z0-9.-])'
condition: selection
falsepositives:
- A credential an administrator deliberately named with the wfx-ci- prefix
level: criticalSee: Attack chain