wfx-loot: 4,837 hijacked GitHub accounts probed 61,764 repos and stole CI secrets

A threat actor holding stolen GitHub credentials has spent the days since 10 November planting a credential-stealing script in thousands of GitHub repositories, and in at least 1,800 of them the script ran and sent secrets to the attacker. Security company Aikido, which named the campaign wfx-loot, counted 4,837 compromised accounts opening probe pull requests in 61,764 repositories. Because the attacker uses real, stolen tokens rather than a bug in GitHub, the usual advice of "update to the fixed version" does not apply: the fix is to look for the traces below and rotate what the workflows could reach.

Key points

• Aikido says the campaign began at about 12:45 UTC on 10 November 2026 and used 4,837 compromised GitHub accounts to open pull requests titled "docs: dependency audit notes" in 61,764 repositories.
• The payload ran in at least 1,806 repositories according to Aikido's detailed write-up (its summary cites 1,835), and it steals GitHub Actions secrets, cloud credentials and AI provider keys.
• Aikido says the script covers its tracks: it reverts its changes within about a minute and deletes the workflow run and logs, so a gap in run numbers may be the only trace.
• The script adds persistence that survives rotating a key, including an AWS role trust policy open to any AWS account and Azure federated identity credentials named wfx-ci-.
• Two published packages carried the payload: Packagist digitalelvis/neuronai-studio 3.14.3 and Go module github.com/onuragtas/docker-env v1.0.278 and v1.0.280.

What to do

Check whether you are affected. Aikido says you may be if any of these appeared in a repository you can write to on or after 10 November:

• a branch called wfx-docs, or a pull request titled docs: dependency audit notes;
• commits titled ci: refresh build cache, chore: add ci helper or chore: add dependency audit workflow;
• a short-lived branch named chore/ followed by eight random characters (Aikido's indicator list also names ci-check- followed by four digits).

Look for gaps in run numbers. The attacker deletes its workflow runs, so a missing run number next to the attacker's commit is, in Aikido's words, the more reliable sign that the payload ran. The absence of artifacts or cache entries proves little, because this campaign sent data straight to two servers over HTTP.

If the probe pull request exists, Aikido's position is that the account that opened it is compromised, even if the workflow stage never ran. Revoke that account's tokens and sessions, and review which repositories it could write to.

If the payload ran, treat every secret and cloud role available to the affected workflows as compromised. Rotating keys is not enough on its own: also check AWS role trust policies for a principal of *, and Azure app registrations for federated credentials whose names begin with wfx-ci-.

Packages: remove digitalelvis/neuronai-studio 3.14.3 (treat any machine that installed or opened it as compromised). Aikido says the Go tags of github.com/onuragtas/docker-env contain the payload only in a workflow file that Go builds never run, but still recommends removing them.

These steps follow Aikido's guidance; the choice of which accounts and roles to audit first is ours and depends on your setup.

What happened

Aikido's report, published on 12 November, describes a campaign that started at about 12:45 UTC on 10 November. The attacker used stolen GitHub credentials, not a vulnerability. For every repository a stolen token can write to, the attacker first opens a pull request titled "docs: dependency audit notes" from a branch called wfx-docs. That confirms write access. Aikido stresses that the pull request is only a probe, followed by commits that carry the real payload.

Aikido counted 61,839 such pull requests on GitHub between 12:45 UTC on 10 November and 15:00 UTC on 11 November. Of the pull requests it analysed, 10,431 went into repositories the compromised account does not own, reached through collaborator or organisation access. That is the point to take away: one stolen token exposes every project its owner can write to. Aikido says 92% of the probe pull requests are still open, which suggests most owners have not noticed.

The payload arrives in one of three ways, according to Aikido: about 1,500 lines added to an existing workflow (commit "ci: refresh build cache"), a postinstall hook in package.json that runs a .ci-xxxxxx.sh script on any npm install ("chore: add ci helper"), or a new workflow file on a throwaway branch ("chore: add dependency audit workflow"). The attacker then reverts the change within at most a minute and deletes the run and its logs.

BleepingComputer, which reported the story on 12 November, adds that some compromised accounts belonged to Fortune 100 organisations, the US General Services Administration, the French government, Nextcloud and WebdriverIO, and that about 50 of the accounts appear to have publishing rights on ecosystems such as npm, PyPI, Go, crates and Packagist. Aikido itself says "at least 50 compromised users appear to publish packages" for those ecosystems; the named organisations are BleepingComputer's account and we could not confirm them in Aikido's text.

How it works

Aikido describes a single shell script of about 1,500 lines that works in four stages, with configuration flags at the top that switch features on and off. It is heavily commented, not obfuscated, and labels itself "wfx" in logs and variable names.

Collect. The script gathers the Actions secrets and variables, the workflow's GITHUB_TOKEN, and the OIDC and Actions runtime tokens. It also collects credential files from well-known paths for AWS, Azure, GCP, Docker, Kubernetes, npm, PyPI, Git, SSH, GPG, Vault and Terraform, shell histories, and tokens for AI tools. Aikido lists OpenAI, Anthropic, Gemini, Hugging Face, Cursor, Copilot, Codex and others. It also reads the memory and environment of the running runner processes.

Escalate. It mints GitHub OIDC tokens for AWS, GCP and Azure audiences and exchanges them for cloud sessions. In AWS it chains into other IAM roles it finds in the repository and calls iam:CreateAccessKey to create long-lived keys. In GCP it uses service account keys to impersonate identities, and in Azure it lists subscriptions and Key Vaults.

Persist. Here the design aims to outlast a clean-up. Aikido says it posts forged success status checks using the names of a repository's required checks, because branch protection matches the check's name, not who posted it. It rewrites a chained AWS role's trust policy to "Principal": {"AWS": "*"}, and adds federated identity credentials to Azure applications that point back to the compromised repository.

Exfiltrate. In this campaign the deployed configuration sent a gzipped archive by HTTP POST to 194.150.166[.]244:8080/exfil or 18.143.168[.]96:8080/exfil. Other channels in the script (the Actions cache, step summaries, artifacts, an encrypted commit, Telegram) were disabled or not triggered in the deployed configuration, per Aikido. Dedicated options for private repositories suggest the payload may also be running in places researchers cannot see.

type: bar
title: How different researchers measure wfx-loot (counts, not directly comparable)
unit: count
source: Aikido; Cloud Security Alliance research note (citing StepSecurity and SafeDep)
highlight: Aikido: repositories probed
StepSecurity: probe pull requests (more than) | 63,000
Aikido: repositories probed | 61,764
SafeDep: repositories with malicious commits | 8,093
Aikido: accounts compromised | 4,837
Aikido: repositories where payload ran (at least) | 1,806

Background

wfx-loot follows a pattern. The Cloud Security Alliance's 12 November research note describes GhostAction as its most direct predecessor, a campaign first discovered in September 2025 that resurfaced in August and October 2026. It cites GitGuardian's October report that GhostAction operators used about 1,900 compromised accounts to target more than 30,000 repositories.

Aikido says accounts hit by GhostAction in October were significantly more likely than baseline to be hit by wfx-loot, and that in more than 100 repositories the new payload was injected into GhostAction's workflow files. Even so, Aikido assesses these are distinct campaigns, probably by different actors, because the infrastructure, tooling and tradecraft differ. It notes Indonesian-language comments in newer versions of the wfx script, which it has not seen in GhostAction.

For readers following this series, our earlier coverage of the Railway breach and stolen AI keys shows how stolen developer credentials get used downstream.

What it means

For developers and maintainers, the lesson is that a repository is only as safe as its most exposed collaborator's token. The Cloud Security Alliance note quotes StepSecurity as saying the attack exploits no vulnerability in GitHub Actions itself. The attacker simply writes code with tokens that were legitimately issued and then stolen. Branch protection did not stop it either, because forged status checks pass a gate that matches on name.

For teams with CI that holds cloud access, the persistence steps matter most. Rotating a secret does not remove an AWS trust policy that trusts every account, or an Azure federated credential that lets the repository sign in without a stored secret. AI provider keys are now an explicit target alongside cloud keys, so keys for model APIs and coding tools belong in the same rotation checklist.

For package consumers the direct risk looks limited so far: Aikido says the attacker appears to be after CI secrets and the package releases were a by-product of automated publishing. But with at least 50 compromised users who publish packages, a repeat is plausible.

What we don't know yet

• The real number of affected repositories. Counts differ by method and time: Aikido says its figure may understate impact, SafeDep reports malicious commits in 8,093 repositories, and the Cloud Security Alliance notes every source agrees the campaign was still active when reported.
• How the attacker obtained 4,837 sets of credentials. Aikido says the accounts overlap with October's GhostAction wave, but does not say how the tokens were first stolen.
• Whether private repositories were hit. The script has private-repository settings, but no source we read confirms it.
• Who is behind it. Aikido assesses the actor is different from GhostAction's.

What to watch next

Watch for GitHub's own response and guidance, further package releases that carry the payload, and updated counts from Aikido, StepSecurity and SafeDep. If you maintain repositories, search your organisation for the pull request title now, before the 92% of unnoticed probes turn into merged changes.

Sources

• Aikido: wfx-loot campaign pushes CI secret stealer to tens of thousands of repositories (primary source, 12 November 2026)
• BleepingComputer: Hackers compromise 4,800 GitHub accounts to steal cloud credentials
• Help Net Security: Check your GitHub repos: A secret stealer hit tens of thousands of them
• Cloud Security Alliance: The wfx Campaign: Hijacked GitHub Accounts Harvest CI Secrets