Stolen GitHub accounts pushed a secret stealer into thousands of repositories

Since November 10, 2026, someone has been using stolen GitHub credentials to slip a credential stealer into repositories those accounts can write to. Security company Aikido, which first reported it on November 12, calls the campaign wfx-loot after the attacker’s own labels: “wfx” for the malware and “loot” for what it steals. The stealer runs in GitHub Actions, and in some repositories on npm install, takes every secret and cloud credential it can reach, and then the attacker deletes the evidence. If you maintain code on GitHub, here’s what to check.

What happened

Aikido says the attacker followed the same steps for each repository a stolen account could write to:

1. A probe. A pull request titled docs: dependency audit notes, opened from a branch named wfx-docs, to check that the account can write to the repository.
2. The payload. One of three changes: about 1,500 lines added to an existing workflow (ci: refresh build cache), a script plus an npm postinstall hook (chore: add ci helper), or a new workflow file on a short-lived chore/ branch (chore: add dependency audit workflow).
3. The clean-up. The change is reverted, often within a minute, and the workflow run is deleted along with its logs. A missing run number in the Actions history is often the only trace left.

Aikido counted 4,837 compromised accounts opening probe pull requests in 61,764 repositories. It found signs that the payload actually ran in more than 1,800 repositories, which means those repositories’ secrets were most likely sent to the attacker. About 10,400 of the probes went into repositories the account didn’t own, through collaborator or organisation access, and 92% of them were still open when Aikido checked, which suggests most owners haven’t noticed.

SafeDep, which looked at the default branches of public repositories, counted 8,093 repositories that received malicious commits between November 10 at 12:46 UTC and November 12 at 04:36 UTC, and found the campaign still running. Its search can’t see private repositories or other branches, so the real number is higher. The Hacker News found more probe pull requests opened early on November 12.

What the stealer takes

According to Aikido and SafeDep, the script collects:

• every GitHub Actions secret and variable, the workflow’s GITHUB_TOKEN and the Actions runtime tokens;
• keys for cloud and AI services found in the runner’s memory and environment;
• credential files for AWS, Azure, Google Cloud, Kubernetes, npm, PyPI and SSH, plus files such as .env and Terraform state;
• a copy of the repository and its recent history.

It then tries to go further. It swaps GitHub’s sign-in tokens for AWS, Azure and Google Cloud sessions, can create new long-lived AWS access keys and rewrite role trust policies, and can add a federated credential named wfx-ci-* to Azure apps, so the attacker keeps a way in even after you rotate your secrets. Data goes out over HTTP to attacker servers or to a Telegram chat.

Packages touched

The attacker seems to be after CI secrets rather than spreading through packages, Aikido says, but a few releases picked up the payload through automatic publishing. SafeDep lists digitalelvis/neuronai-studio v3.14.3 on Packagist, and some versions of the Go modules github.com/vkuznet/gocurl and github.com/onuragtas/redock (also docker-env). A normal composer require or go get doesn’t run the payload, but SafeDep advises blocking those versions anyway. The stealer also reached 28 WebdriverIO repositories through commits made as the project’s bot account. No WebdriverIO release was affected, but the bot’s token should be treated as stolen.

The GhostAction link

Aikido found that the accounts used this week overlap heavily with those hijacked in October’s GhostAction wave, which we covered as a live story: accounts hit then were about 1,000 times more likely than other active accounts to be used now, and in more than 100 repositories the new stealer was added to GhostAction’s old workflow files. Aikido says it doesn’t attribute the November campaign to the same actor at this stage, because the tools and infrastructure differ and stolen credentials often end up with several attackers. When we closed that story on November 3, many of the hijacked accounts were still usable as of October 21, and GitGuardian expected new waves.

How to tell if you were hit

Look in every repository you can write to, from November 10 onward, for:

• a wfx-docs branch or a pull request titled docs: dependency audit notes;
• commits titled ci: refresh build cache, chore: add ci helper, chore: add dependency audit workflow, ci: restore or ci: cleanup;
• short-lived branches named chore/ followed by eight random characters;
• a gap in your Actions run numbers right after one of those commits.

A probe pull request on its own means the account that opened it is compromised, even if no payload followed, Aikido says.

What you can do

1. Lock down the account that made the commits. Revoke its personal access tokens, OAuth app grants, SSH keys and sessions, change its password and turn on two-step sign-in with a passkey or security key.
2. If the payload ran, rotate everything the workflows could read: repository, environment and organisation secrets, cloud keys and roles, and any AI service keys.
3. Hunt for leftover cloud access. In Microsoft Entra ID, look for federated credentials named wfx-ci-*. In AWS CloudTrail, look for sessions named wfx-* followed by CreateAccessKey or UpdateAssumeRolePolicy.
4. If anyone ran npm install on an affected commit, treat that computer as compromised and rotate its keys.
5. Close the probe pull request and delete the wfx-docs branch, then republish any package built from an affected commit from a clean one.

If you don’t write code

You don’t need to do anything yourself. The risk is to developers and companies whose build systems hold keys. If an app or service you use tells you it was affected, follow its advice and watch for unusual sign-in alerts.

How Frame helps

This campaign steals developer and cloud secrets, not a list of personal email addresses, so there isn’t a breach record to add in Frame. Frame can also look up your verified emails in Have I Been Pwned’s breach database for other breaches. Frame doesn’t scan code repositories.

Related coverage

• Hijacked developer accounts are planting credential stealers on GitHub and npm: our live coverage of GhostAction, whose hijacked accounts overlap with this campaign.
• Railway’s final report: stolen AI keys ran up about $740,000 in charges: what stolen AI service keys can cost.
• A malicious Ruby gem ran a credential-stealing worm as soon as it was installed: another recent attack aimed at developers’ secrets.

Sources

• Aikido Security, wfx-loot campaign pushes CI secret stealer to tens of thousands of repositories, November 12, 2026
• SafeDep, wfx: GitHub Actions Credential Stealer Hits 8,000 Repos, November 12, 2026
• StepSecurity, WFX Phantom: The GitHub Actions Secret Stealer That Deletes Its Tracks, November 2026
• The Hacker News, Attacker Used 4,837 Hijacked GitHub Accounts to Run a CI Secret Stealer in 1,806+ Repositories, November 12, 2026
• Help Net Security, Check your GitHub repos: A secret stealer hit tens of thousands of them, November 12, 2026