A credential-stealing campaign tracked as wfx-loot used thousands of compromised GitHub accounts to probe tens of thousands of repositories and lifted secrets from at least 1,835 targets, according to researchers at application security company Aikido. The operation targeted GitHub Actions secrets and cloud credentials, and the stolen accounts included ones belonging to Fortune 100 organizations, the US General Services Administration, the French government, Nextcloud, and WebdriverIO. Aikido said the campaign began around 12:45 UTC on November 10, when the attacker drew on stolen credentials from 4,837 compromised accounts to check 61,764 repositories for write access.
The actor opened pull requests titled "docs: dependency audit notes" while testing whether the compromised accounts had enough write permission to inject malicious code, Aikido reported. Of those pull requests, 92% remain open, which the researchers said suggests the legitimate repository owners did not notice the activity. About 50 of the compromised accounts appear to hold publishing rights on other open-source software ecosystems and package indexes, including npm, PyPI, Go, crates, and Packagist.
According to Aikido, the payload was a 1,500-line credential-stealing shell script delivered by modifying an existing GitHub Actions workflow, adding a new workflow on a short-lived branch, or planting an npm install hook. The script can exchange GitHub OIDC tokens for temporary AWS, Azure, and GCP cloud sessions, and in AWS it can chain into additional IAM roles present in the repository to create long-lived credentials for IAM users. It also uses collected service-account credentials to impersonate identities in GCP, and Aikido said its capabilities include establishing persistent access by creating long-lived credentials or modifying cloud identity and trust policies where permissions allow.
The script compressed the collected data into tarballs and exfiltrated it through HTTP POST to one of two attacker-controlled endpoints, according to the researchers. In the final stage, the attacker reverted the changes and deleted workflow runs and logs in under a minute, Aikido said. Automated publishing carried the payload into Packagist's digitalelvis/neuronai-studio 3.14.3 and two versions of the Go module github.com/onuragtas/docker-env, v1.0.278 and v1.0.280.
Aikido believes the threat actor's main objective was stealing CI secrets, with the package releases a byproduct of automated publishing. The researchers also found certain overlaps with the 2025 GhostAction campaign.
Repository owners are advised to look for the wfx-docs branch, the probe pull request, and gaps in workflow run numbers. Where payload execution is confirmed, all secrets and cloud roles available to the affected workflows should be considered compromised and rotated immediately.
More cybersecurity news from TechManNews.
