If you can push to a GitHub repository, look for a pull request called “docs: dependency audit notes”. Security firm Aikido says a campaign it has named wfx-loot has abused stolen GitHub tokens since 10 November to plant a credential stealer in tens of thousands of projects. Where it ran, every secret the repository’s workflows could reach should be treated as lost.
Aikido counts 4,837 hijacked accounts that sent probe requests to 61,764 repositories. By its own indicators the stealer executed in at least 1,806 of them, and the true figure is likely larger, since the attacker erases the workflow run and its logs within about a minute.
It began around 12:45 UTC on 10 November. Each repository the token can modify gets a test first: the attacker opens a pull request from a branch called wfx-docs to check the token really works there. Aikido says GitHub search shows 61,839 of them. Of those, 10,431 targeted other people’s projects that the hijacked user could write to through a team role. Roughly nine in ten remain unmerged and unclosed, which suggests nobody has looked.
The real payload follows in one of three shapes. A commit titled “ci: refresh build cache” stuffs some 1,500 extra lines into a workflow that already exists. “chore: add ci helper” hides a script in the project and hooks it into package.json, so a routine npm install fires it. The third makes a short-lived chore/ branch holding a new build-audit workflow. A gap in the run numbering is often the only sign left.
The payload is one long, well-commented shell script. Its targets include Actions secrets, the workflow token, cloud login files, command histories, private keys and .env files, plus API keys for AI services. It then tries to widen its reach into cloud accounts, fakes passing status checks to get past branch protection, and in AWS edits a role’s trust policy so any account can assume it. In this run it posts the loot to two servers on port 8080; Aikido says the other upload routes were turned off.
Some packages have been touched too. Aikido names version 3.14.3 of the Packagist package digitalelvis/neuronai-studio, and versions 1.0.278 and 1.0.280 of the Go module github.com/onuragtas/docker-env. In the Go module the payload lives only in a workflow file, so people who merely import it may be fine. Aikido also found at least 50 of the hijacked users publish software through package registries.
Many victims were also hit by GhostAction, an October secret-stealing wave, and Aikido found wfx-loot inside GhostAction’s own workflow files in more than 100 repositories. It still treats them as separate campaigns by different actors. Anyone who finds the branch, commit titles or pull request should rotate the secrets and cloud roles their workflows could use, and review cloud logs for anything since 10 November.
