Attackers used credentials from 4,837 compromised GitHub accounts to test 61,764 repositories for write access, then planted a 1,500-line credential stealer in the projects that let them in. Researchers at security firm Aikido found at least 1,835 repositories ran the payload, which collected cloud logins and developer secrets, BleepingComputer reported on 12 November.
The campaign, tracked as wfx-loot, started around 12:45 UTC on 10 November. Each attempt opened a pull request titled “docs: dependency audit notes” from a branch named wfx-docs, a probe to see whether the stolen account could write to the repository. Aikido said 92% of those pull requests were still open when it checked, a sign that owners had not noticed the activity. The researchers did not say how the accounts were taken over.
Where write access existed, the attacker took one of three routes: editing an existing GitHub Actions workflow, adding a new workflow file on a short-lived branch, or adding a shell script that runs from an npm install hook.
The script searched the build environment for GitHub Actions secrets, workflow tokens and cloud credentials for AWS, Azure and Google Cloud, including secrets exposed through instance metadata on self-hosted runners. It also hunted SSH keys, Docker and Kubernetes configuration, npm and PyPI tokens, Vault and Terraform credentials, .env files, and API keys for OpenAI, Anthropic, Gemini, Hugging Face, Cursor and GitHub Copilot.
From there the script tried to go deeper. It exchanged GitHub OIDC tokens for temporary cloud sessions, chained into IAM roles in AWS to create long-lived access keys, and used service-account credentials to pose as identities in Google Cloud. Some steps were built to survive a password reset: the code rewrote AWS role trust policies and added federated identity credentials prefixed wfx-ci- to Azure AD applications.
Collected data left the runners as compressed archives posted to attacker-controlled servers, or in some cases to a Telegram chat. The attacker then reverted the changes and deleted workflow runs and logs, which Aikido said took under a minute, though a second analysis found some changes left in place for longer. A separate count by supply chain firm SafeDep, cited by The Hacker News, put 8,093 repositories with malicious commits between 12:46 UTC on 10 November and 04:36 UTC on 12 November. SafeDep searched default branches of public repositories only, so the true figure is higher.
Some of the compromised accounts belonged to Fortune 100 organisations, the US General Services Administration, the French government, Nextcloud and WebdriverIO. About 50 appeared to hold publishing rights on npm, PyPI, Go, crates and Packagist.
That reach carried the stealer into the software supply chain. Version 3.14.3 of the Packagist package digitalelvis/neuronai-studio carried the payload, as did versions 1.0.278 and 1.0.280 of the Go module github.com/onuragtas/docker-env inside a workflow file. Aikido said the releases looked like a byproduct of automated publishing rather than the goal.
The researchers also found overlaps with the 2025 GhostAction campaign, though Aikido said it does not attribute this month’s activity to the same actor. Repository owners were told to look for the wfx-docs branch, the probe pull request and gaps in workflow run numbers, and to treat every secret and cloud role a workflow could reach as compromised. SafeDep advised owners to revoke the commit author’s tokens, OAuth grants, SSH keys and sessions, and to turn on two-factor authentication.
The stealer also carried settings for private repositories. Anyone who ran npm install on an affected commit should treat that machine as exposed and rotate its keys, SafeDep said.
