Compromised GitHub accounts push CI secret stealer to tens of thousands of repositories - Aikido Security
Starting November 10, threat actors used stolen GitHub credentials to push a malicious workflow into tens of thousands of repositories, stealing CI secrets and cloud credentials.
The attack, dubbed 'wfx-loot' by researchers at Aikido Security, began on November 10, 2026, when threat actors exploited stolen GitHub credentials to spread malicious workflows across repositories. The payload specifically targets GitHub Actions secrets and cloud credentials, with at least 1,835 repositories confirmed to have been compromised and credentials exfiltrated.
According to data collected by Aikido Security, 4,837 compromised accounts opened probe pull requests in 61,764 repositories. Notably, 10,431 of these pull requests targeted repositories the compromised accounts didn't own, accessed through collaborator or organization permissions. The campaign has also spread to at least one Packagist and one Golang package through automated publishing triggers.
Attack Methodology
The threat actor employs a three-stage attack process. First, they probe repositories by opening a 'docs: dependency audit notes' pull request from a 'wfx-docs' branch to confirm write access. Next, they push one of three payload variants: workflow injection, install hook, or throwaway branch. Finally, they clean up by reverting changes and deleting workflow logs within a minute, leaving few traces behind.
If the probe ran, that user is compromised, even if the workflow stage did not run.
What's Stolen
The malicious payload collects credentials from every available source on the runner, including GitHub Actions secrets, variables, and tokens. It scans for credential files from AWS, Azure, GCP, Docker, Kubernetes, and various AI provider tokens including OpenAI, Anthropic/Claude, and Hugging Face. The payload also captures shell histories, environment variables, and a snapshot of the repository.
The attack escalates privileges by using collected credentials to gain deeper cloud access through OIDC exchanges, AWS role chaining, GCP service account impersonation, and Azure federated identity injection. It also implements persistence measures like branch protection bypass and trust policy rewrites to maintain access even after credential rotation.
Detection and Response
Researchers warn that the absence of wfx-loot artifacts or cache entries doesn't mean data wasn't stolen, as the threat actor typically deletes workflow runs. A missing run number on the attacker's commit is a more reliable indicator that the payload ran. The campaign shows overlap with October's GhostAction activity, suggesting coordinated attacks targeting GitHub security.
Affected repositories should assume all secrets and cloud roles available to their workflows are compromised. Organizations should immediately review repositories for suspicious pull requests titled 'docs: dependency audit notes' or containing commits with titles like 'ci: refresh build cache' or 'chore: add ci helper' since November 10.
Related
