A campaign tracked as wfx-loot used thousands of compromised GitHub accounts to target tens of thousands of repositories with malicious GitHub Actions workflows designed to steal secrets and cloud credentials. Although not every targeted repository executed the payload, researchers confirmed secrets were stolen from at least 1,835 targets. Among the compromised accounts were those belonging to Fortune 100 organizations, the US General Services Administration, the French government, Nextcloud, and WebdriverIO.

Attack details

According to application security firm Aikido, the activity began around 12:45 UTC on November 10. The attacker used stolen GitHub credentials from 4,837 accounts to probe 61,764 repositories for write access, opening pull requests titled “docs: dependency audit notes” to test permissions. About 92% of those pull requests remain open, suggesting repository owners did not notice them.

The attacker then delivered a roughly 1,500-line credential-stealing shell script by modifying an existing workflow, adding a new workflow on a short-lived branch, or planting an npm install hook. The script targeted:

  • GitHub Actions secrets and variables, along with workflow tokens and OIDC and runtime tokens.
  • Cloud credentials for AWS, Azure, and Google Cloud, including those exposed through instance metadata on self-hosted runners.
  • Developer and infrastructure credentials for Git, SSH, GPG, Docker, Kubernetes, npm, PyPI, Vault, and Terraform.
  • Credentials for AI services and developer tools, including OpenAI, Anthropic, Gemini, Hugging Face, Cursor, and GitHub Copilot.

The script also attempted cloud privilege escalation by exchanging GitHub OIDC tokens for temporary AWS, Azure, and GCP sessions, chaining into additional IAM roles, and where permissions allowed, creating long-lived credentials or modifying trust policies to maintain persistence. Collected data was compressed and exfiltrated via HTTP POST to attacker-controlled endpoints. Aikido reports the attacker reverted changes and deleted workflow runs and logs in under a minute.

Package impact

Automated publishing carried the payload into the Packagist package digitalelvis/neuronai-studio 3.14.3 and two versions of the Go module github.com/onuragtas/docker-env. Researchers believe these releases were a byproduct of automated publishing rather than the primary objective, which they assess was CI secret theft. They also noted some overlaps with the 2025 GhostAction campaign.

Recommended actions

Repository owners should check for a branch named wfx-docs, the probe pull request, and gaps in workflow run numbers. Where payload execution is confirmed, all secrets and cloud roles available to the affected workflows should be treated as compromised and rotated immediately.