Key Takeaways
- Aikido Security said 4,837 compromised GitHub accounts opened probe pull requests in 61,764 repositories in the wfx-loot campaign, which began at about 12:45 UTC on November 10, 2026.
- Aikido said the wfx-loot credential stealer ran and sent credentials to the attacker in at least 1,835 GitHub repositories, after which the attacker reverted the change and deleted the workflow run and its logs.
- StepSecurity said the wfx-loot attacker did not exploit a bug in GitHub Actions and instead used valid tokens for real developer and bot accounts.
- Aikido advised treating every secret and cloud role available to a repository's workflows as compromised if the wfx-loot payload ran in that repository.
What happened
Starting at about 12:45 UTC on November 10, 2026, an attacker used stolen GitHub credentials to push malicious code into tens of thousands of code repositories, the application security company Aikido Security said in a report published November 12. Aikido tracks the campaign as wfx-loot, after the attacker's own name for the malware and the term used for stolen secrets.
The security firms SafeDep and StepSecurity published their own analyses on November 12. SafeDep calls the malware wfx, and StepSecurity's report calls it wfx phantom.
The code targets GitHub Actions, a continuous integration and continuous delivery (CI/CD) platform that automates building, testing, and deploying software, according to GitHub's documentation. It steals GitHub Actions secrets, which hold sensitive information for use in those automated workflows, along with cloud credentials, Aikido said.
"The attacker does not exploit a bug in GitHub Actions," StepSecurity said. The attacker instead uses valid tokens for real developer and bot accounts, according to StepSecurity. SafeDep said the malicious commits appear under the names of real users of each repository, which points to stolen tokens.
How the attack worked
For each repository a stolen token could write to, the attacker first opened a pull request, a proposal to merge code changes into a project, Aikido said. StepSecurity said the pull request does nothing by itself and only tells the attacker that the token can write to the repository.
The attacker then pushed a single shell script of about 1,500 lines, Aikido said. It hid the script in an existing workflow, in a new workflow on a throwaway branch, or in a hook that runs whenever someone installs the project's npm dependencies. SafeDep said that hook runs the script on each install, whether on a build server or on a developer's laptop.
According to Aikido, the script collects repository secrets, cloud credentials for Amazon Web Services (AWS), Microsoft Azure, and Google Cloud, and credentials for AI providers and tools such as OpenAI, Anthropic, and Gemini. SafeDep said the script also tries to leave backdoors in AWS and Azure that survive a secret rotation.
The attacker then reverted the change within at most one minute and deleted the workflow run along with its logs, Aikido said. A missing run number in the workflow's history is often the only trace, according to Aikido.
Who is affected
Aikido counted 4,837 compromised accounts that opened probe pull requests in 61,764 repositories. It said at least 1,835 repositories ran the payload and had credentials stolen. As of 07:40 UTC on November 12, a GitHub search returned more than 63,000 of the probe pull requests, about 90% of them still open, StepSecurity said.
SafeDep counted 8,093 repositories that received malicious commits between 12:46 UTC on November 10 and 04:36 UTC on November 12. SecurityWeek noted that this count does not necessarily mean the code ran.
Some of the compromised accounts belonged to Fortune 100 organizations, the US General Services Administration, the French government, Nextcloud, and WebdriverIO, BleepingComputer reported.
At least 50 of the compromised users appear to publish packages for software ecosystems including npm, Go, Packagist, PyPI, and crates, Aikido said. Through automated publishing, the payload reached version 3.14.3 of the Packagist package digitalelvis/neuronai-studio and into versions 1.0.278 and 1.0.280 of the Go module github.com/onuragtas/docker-env, according to Aikido. Aikido said the attacker appears to be after CI secrets rather than trying to spread through the software supply chain.
What is still unknown
GitHub's records show that 173 of the probe pull requests, opened from 19 accounts, came through the Fly.io GitHub app, StepSecurity said. That means the attacker held tokens GitHub had issued to that app, according to StepSecurity. StepSecurity said it had not established how the tokens were obtained and had no evidence of a breach of Fly.io's own infrastructure. Most of the campaign's activity used other credentials, such as personal access tokens, according to StepSecurity.
Aikido found that accounts hit by GhostAction, a similar campaign in October, were significantly more likely than others to be hit by wfx-loot. Aikido assessed that the two are distinct campaigns likely carried out by different threat actors. StepSecurity said the overlap does not prove a single actor but shows that "an account compromised once tends to be compromised again."
What organizations should do
Aikido advised treating every secret and cloud role available to a repository's workflows as compromised if the payload ran there. StepSecurity advised searching pull requests and commits made since November 10 for the titles the researchers published. It then advised looking for a missing run number right after the attacker's commit, which it said means the stealer probably ran.
StepSecurity advised rotating every secret the affected job could reach, including npm, PyPI, and other publishing tokens, and removing the backdoors the stealer leaves in cloud accounts, because rotation alone does not remove them. It also advised revoking the compromised account's personal access tokens, OAuth app grants, and SSH keys and signing out its sessions. Anyone who ran npm install on an affected project in the minute or two before the attacker reverted the change ran the stealer on their own machine and should rotate their credentials too, StepSecurity said.
SafeDep advised owners of affected repositories to rotate every secret the repository can read and check their cloud accounts for backdoors. Aikido, SafeDep, and StepSecurity published the pull request titles, commit messages, and other indicators in their reports.