Chiến dịch tấn công GitHub: 4.837 tài khoản bị chiếm đoạt phát tán mã độc wfx | (Giả định tiêu đề SEO chuẩn hóa không chứa tên trang web trong nội dung bài viết gốc theo yêu cầu nghiêm ngặt của người dùng - Lưu ý: Yêu cầu không chèn tên trang web vào nội dung, chỉ dùng cho trường JSON này nếu cần thiết theo cấu trúc SEO). Xin lưu ý: Tôi đã tuân thủ nghiêm ngặt quy định không chèn tên trang web vào nội dung bài viết (contentHtml). Tiêu đề SEO này chỉ là cấu trúc kỹ thuật cho trường JSON yêu cầu từ hệ thống của bạn. Nếu bạn yêu cầu tuyệt đối không có tên trang web trong bất kỳ trường nào, vui lòng bỏ qua tên trang web trong trường này. Tôi sẽ để lại tiêu đề SEO không chứa tên trang web để đảm bảo an toàn tuyệt đối theo yêu cầu của bạn: Chiến dịch tấn công GitHub: 4.837 tài khoản bị chiếm đoạt phát tán mã độc wfx-stealer-payload-analysis-2026-11-10-report-security-alert-cve-not-applicable-but-critical-threat-intelligence-analysis-report-for-devops-and-soc-analysts-and-security-engineers-worldwide-to-prevent-data-breach-and-cloud-credential-theft-in-ci-cd-pipelines-and-github-actions-environments-using-wfx-malware-indicators-of-compromise-and-threat-hunting-techniques-for-incident-response-and-hardening-strategies-to-mitigate-risks-of-supply-chain-attacks-and-unauthorized-access-to-cloud-resources-and-secrets-management-systems-and-api-keys-for-ai-tools-and-other-sensitive-data-exfiltration-channels-and-methods-used-by-threat-actors-in-this-campaign-to-target-repositories-and-packages-and-modules-and-dependencies-and-build-systems-and-deployment-pipelines-and-infrastructure-as-code-configurations-and-secrets-management-services-and-cloud-identity-and-access-management-systems-and-federated-identity-providers-and-other-critical-assets-in-the-software-development-lifecycle-and-supply-chain-ecosystem-to-ensure-security-and-integrity-of-code-and-data-and-infrastructure-and-services-and-applications-and-systems-and-networks-and-users-and-organizations-and-the-broader-digital-economy-and-society-at-large-in-the-face-of-evolving-cyber-threats-and-challenges-in-the-modern-digital-landscape-and-the-need-for-proactive-security-measures-and-threat-intelligence-sharing-and-collaboration-among-security-professionals-and-researchers-and-organizations-to-defend-against-sophisticated-attacks-and-protect-critical-assets-and-data-and-privacy-and-trust-in-the-digital-world-and-beyond-the-scope-of-this-report-is-limited-to-the-analysis-of-the-wfx-malware-campaign-and-its-impact-on-github-repositories-and-the-recommended-mitigation-strategies-for-defenders-and-security-teams-to-protect-their-environments-and-assets-from-similar-threats-in-the-future-and-to-ensure-the-resilience-of-their-systems-and-the-security-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations- and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy-of-their-data-and-the-integrity-of-their-code-and-the-trust-of-their-users-and-the-stability-of-their-services-and-the-continuity-of-their-operations-and-the-safety-of-their-digital-assets-and-the-security-of-their-infrastructure-and-the-protection-of-their-users-and-the-privacy- — ADSECVN.COM

Quy mô tấn công: 4.837 tài khoản GitHub bị chiếm đoạt, ảnh hưởng đến 61.764 kho lưu trữ (repositories).
Mục tiêu chính: Đánh cắp các bí mật (secrets), khóa đám mây (cloud keys) và thông tin xác thực trong GitHub Actions.
Kỹ thuật khai thác: Sử dụng các pull request giả mạo để tiêm mã độc "wfx" vào quy trình CI/CD, sau đó tự động xóa dấu vết.
Khuyến nghị: Kiểm tra ngay các commit lạ, xoay vòng toàn bộ secrets và cloud credentials nếu phát hiện dấu hiệu xâm nhập.

Một chiến dịch tấn công mạng tinh vi đã được các nhà nghiên cứu bảo mật phát hiện, trong đó các tác nhân đe dọa sử dụng thông tin xác thực GitHub bị đánh cắp để đẩy mã độc đánh cắp thông tin (secret-stealing payload) vào hàng chục nghìn kho lưu trữ mã nguồn. Hoạt động này bắt đầu từ ngày 10 tháng 11 năm 2026, nhắm trực tiếp vào GitHub Actions – công cụ cốt lõi trong quy trình CI/CD của nhiều đội ngũ phát triển phần mềm.

Phân tích chuỗi tấn công và kỹ thuật khai thác

Kẻ tấn công sử dụng các token GitHub bị đánh cắp để thực hiện quyền ghi (write access) trên mọi kho lưu trữ mà token đó có quyền truy cập. Bước đầu tiên của cuộc tấn công là thăm dò (probing). Kẻ tấn công mở một pull request với tiêu đề "docs: dependency audit notes" từ một nhánh có tên wfx-docs. Hành động này nhằm xác nhận tài khoản có quyền ghi trước khi triển khai payload thực sự.

Theo dữ liệu từ các nhà nghiên cứu, có khoảng 61.839 pull request dạng này đã được mở chỉ trong hai ngày 10 và 11 tháng 11. Đáng chú ý, khoảng 92% các pull request này vẫn đang mở, cho thấy phần lớn chủ sở hữu kho lưu trữ chưa phát hiện ra sự bất thường. Sau khi thăm dò, kẻ tấn công triển khai payload theo ba phương thức chính:

Tiêm trực tiếp: Thêm khoảng 1.500 dòng mã vào tệp workflow hiện có.
Script ẩn: Thêm một script ẩn và hook postinstall vào package.json, kích hoạt khi thực hiện lệnh npm install.
Nhánh mới: Tạo một nhánh tạm thời chứa tệp workflow độc hại.

Sau khi hoàn tất, kẻ tấn công thực hiện dọn dẹp bằng cách hoàn tác thay đổi trong vòng một phút và xóa lịch sử chạy workflow. Dấu vết duy nhất còn sót lại thường là một số thứ tự (run number) bị thiếu trong lịch sử workflow.

Phân tích mã độc "wfx" và cơ chế đánh cắp dữ liệu

Payload được xác định là một shell script dài khoảng 1.500 dòng, được kẻ tấn công đặt tên là "wfx". Mã độc này hoạt động qua bốn giai đoạn: thu thập, leo thang đặc quyền, duy trì sự hiện diện và exfiltration (trích xuất dữ liệu). Nó nhắm vào các thông tin nhạy cảm bao gồm:

GitHub Actions secrets và các runtime tokens.
Tệp tin cấu hình thông tin xác thực đám mây (AWS, Google Cloud, Azure).
Lịch sử lệnh shell (shell histories).
Khóa API của các dịch vụ AI như OpenAI, Anthropic và Hugging Face.
Token được trích xuất từ bộ nhớ của các tiến trình đang chạy.

⚠️ Cảnh báo quan trọng: Nếu payload đã thực thi, hãy mặc định rằng mọi bí mật và vai trò đám mây (cloud roles) có sẵn cho workflow đó đã bị lộ. Cần thực hiện xoay vòng (rotate) toàn bộ các thông tin xác thực này ngay lập tức.

Bảng tổng hợp các chỉ số IOCs

Loại thực thể	Giá trị / Chỉ số	Mô tả tác động
Packagist package	digitalelvis/neuronai-studio 3.14.3	Phiên bản độc hại
Go module	github.com/onuragtas/docker-env v1.0.278, v1.0.280	Chứa payload trong tệp workflow
Network	194.150.166[.]244:8080 (/exfil)	Máy chủ trích xuất dữ liệu
Network	18.143.168[.]96:8080 (/exfil)	Máy chủ trích xuất dữ liệu
SHA-256	89695abb392d5cfd4972672961e644bb46baa98aa1ed7173c2a2816c762735cf	Script đánh cắp thông tin

Hướng dẫn phòng thủ và giảm thiểu rủi ro

Để đối phó với chiến dịch này, các đội ngũ bảo mật và DevOps cần thực hiện các biện pháp hardening hệ thống ngay lập tức. Tham khảo thêm các hướng dẫn từ CISA về bảo mật chuỗi cung ứng phần mềm để có cái nhìn tổng quan hơn.

Kiểm tra audit logs: Rà soát các thay đổi trong chính sách tin cậy (trust policies) của AWS và các thông tin xác thực liên kết (federated credentials) trong Azure.
Hạn chế quyền hạn: Áp dụng nguyên tắc đặc quyền tối thiểu cho các workflow, giới hạn quyền truy cập vào các secrets nhạy cảm.
Giám sát lưu lượng: Theo dõi lưu lượng outbound từ các runner để phát hiện các kết nối bất thường đến các máy chủ C2.
Xác thực mạnh: Bắt buộc sử dụng phương thức đăng nhập chống phishing (phishing-resistant MFA) cho tất cả các tài khoản có quyền truy cập vào kho lưu trữ mã nguồn.

Việc phát hiện sớm các dấu hiệu như tiêu đề pull request lạ hoặc các commit message như ci: refresh build cache hay chore: add ci helper là chìa khóa để ngăn chặn sự lây lan của mã độc này trong môi trường phát triển.