---
title: "wfx-loot: 4,837 GitHub Accounts Used to Steal CI Secrets"
url: https://playciso.com/blog/wfx-loot-github-accounts-ci-secrets-stealer
updated: 2026-11-13
section: Blog
publisher: PlayCISO
---

# wfx-loot: 4,837 GitHub Accounts Used to Steal CI Secrets

> Hijacked GitHub accounts opened 61,764 probe PRs and ran a CI secret stealer that deletes its own runs. How to check your repos and what to rotate.

Source: https://playciso.com/blog/wfx-loot-github-accounts-ci-secrets-stealer · Published: 2026-11-13 · Publisher: PlayCISO (https://playciso.com)

Primary source: https://www.aikido.dev/blog/compromised-github-accounts-push-ci-secret-stealer-to-tens-of-thousands-of-repositories

---

From about 12:45 UTC on 10 November 2026, an attacker used **4,837 compromised GitHub accounts** to open probe pull requests in **61,764 repositories**, then planted a CI secret stealer wherever those accounts could write, according to Aikido Security, which named the campaign **wfx-loot**. Aikido says the payload ran and credentials were exfiltrated in **at least 1,835 repositories** (later in the same post it gives at least 1,806). The attacker reverted each change within a minute and deleted the workflow run and its logs, so a gap in run numbers is often the only trace. No GitHub vulnerability is involved and GitHub has not commented.

**Who this is for:** anyone who owns or can write to GitHub repositories with Actions secrets or cloud roles, and the security leaders who will be asked "were we in this?".

*Independent analysis. PlayCISO is not affiliated with any organisation named. Facts are as published by 13 November 2026 and may change.*

Confirmed vs not yet known

**Reported by researchers (Aikido, Endor Labs, StepSecurity, SafeDep):** the probe pull requests, the three delivery methods, the run-deletion cleanup, the cloud escalation and persistence behaviour, the Packagist and Go packages that carried the payload, and repositories at Nextcloud and WebdriverIO among those hit (named by Endor Labs).

**Differs between sources:** how many repositories ran the payload (Aikido gives 1,835 and 1,806 in the same post; SafeDep counts 8,093 repositories with malicious commits, not all of which ran); how many probe pull requests remain open (Aikido says 92% of the 10,431 opened in repositories the account does not own; BleepingComputer applies 92% to all of them).

**Not known:** how the 4,837 accounts were compromised; who is behind it; whether GitHub has acted. BleepingComputer writes that some accounts belonged to Fortune 100 organisations, the US General Services Administration and the French government; Aikido's post names no organisation, and we found no statement from those bodies.

## Timeline

| When (UTC) | What | Source |
| --- | --- | --- |
| 10 Nov, about 12:45 | Probe pull requests begin | Aikido |
| 10 Nov 12:46 to 12 Nov 04:36 | Malicious commits observed | SafeDep, via The Hacker News |
| 11 Nov 06:33 | First victim disclosure | Endor Labs |
| 11 Nov 12:11 | WebdriverIO repositories hit; revert at 12:30 | Endor Labs |
| 11 Nov 15:00 | 61,839 "docs: dependency audit notes" pull requests found by GitHub search since 10 Nov 12:45 | Aikido |
| 12 Nov 07:40 | More than 63,000 probe pull requests | StepSecurity, via the Cloud Security Alliance |
| 12 Nov | Aikido, StepSecurity and Endor Labs publish; BleepingComputer and The Hacker News report | Each publication |

## How the attack worked

- Probe. Each compromised account opened a pull request titled docs: dependency audit notes from a wfx-docs branch, to learn which repositories it could write to. Aikido also lists chore/ plus eight characters and ci-check- plus four digits as branch patterns.

- Deliver. Where it could write, the attacker used one of three methods (Aikido): about 1,500 lines added to an existing workflow (commit ci: refresh build cache); a hidden .ci- shell script plus an npm postinstall hook (commit chore: add ci helper); or a new build-audit- workflow file on a throwaway chore/ branch (commit chore: add dependency audit workflow). StepSecurity also saw the payload appended to existing CI shell scripts.

- Steal. The script collects Actions secrets and variables, the workflow's GITHUB_TOKEN, OIDC and runtime tokens; credentials for cloud, Docker, Kubernetes, npm, PyPI, Git, SSH, GPG, Vault and Terraform; AI provider and AI developer-tool credentials; environment variables, .env and key files, shell histories and runner memory; on self-hosted runners, cloud instance-metadata credentials; and a snapshot of the repository and its last 100 commits.

- Escalate and persist. Per Aikido, it exchanges GitHub OIDC tokens for AWS, Azure and GCP sessions, chains into IAM roles found in the repository and creates long-lived AWS access keys, impersonates GCP service accounts, and replays tokens against Vault and Kubernetes. Where permissions allow, it rewrites an AWS role's trust policy to allow any AWS account and adds Azure federated identity credentials named wfx-ci-; both survive secret rotation. It also posts forged "success" status checks to get past branch protection.

- Exfiltrate and clean up. The loot is packed into a compressed archive and sent by HTTP POST to one of two attacker servers. The attacker then reverts the change within at most a minute and deletes the workflow run and its logs. Aikido: "A missing run number in the workflow's history is often the only trace."

## Who was hit

- Nextcloud and WebdriverIO. Endor Labs names nextcloud/docker and about 20 WebdriverIO repositories, and says both were detected and addressed quickly. The Cloud Security Alliance, citing StepSecurity and Endor Labs, says commits from the WebdriverIO bot account got past branch protection and landed 56 commits across 28 repositories. We found no statement from either project.

- Government and large companies. BleepingComputer writes that some compromised accounts belonged to Fortune 100 organisations, the US General Services Administration and the French government. Aikido's write-up names no organisation, and we could not trace the source of that list.

- Package ecosystems. Aikido says at least 50 compromised users appear to publish packages on npm, Go, Packagist, PyPI or crates. Automated publishing carried the payload into Packagist digitalelvis/neuronai-studio 3.14.3 and the Go module github.com/onuragtas/docker-env v1.0.278 and v1.0.280. Aikido believes the attacker wanted CI secrets and the releases were a by-product.

## How it relates to GhostAction

GhostAction, the campaign that pushed fake "Security Audit" workflows in October 2026 (see our [October roundup](/blog/october-2026-hacks-roundup-whats-confirmed)), overlaps in accounts. Aikido says accounts hit by GhostAction in October "were significantly more likely than baseline to be impacted by wfx-loot", and that in more than 100 repositories wfx-loot was injected into GhostAction's workflow files. But it assesses "these are distinct campaigns likely carried out by different threat actors", because "the infrastructure, tooling and tradecraft differ, and stolen credentials often end up in the hands of several threat actors". The lesson is the same either way: a GitHub account that was compromised once and not fully cleaned up gets used again.

## What security leaders should do this week

- Search every repository you can write to from 10 November on: a wfx-docs branch, a docs: dependency audit notes pull request, the three commit messages above and short-lived chore/ branches.

- Look for gaps in workflow run numbers around those commits. Aikido calls this the most reliable sign the payload ran.

- Treat the account as compromised if a probe pull request came from it, even if no payload ran: revoke its tokens, sessions, OAuth apps and SSH keys.

- Rotate everything the workflow could reach if the payload ran: every secret and every cloud role available to that repository's workflows.

- Remove the persistence that survives rotation: AWS role trust policies opened to any AWS account, and Azure federated identity credentials named wfx-ci-.

- Remove the affected packages: neuronai-studio 3.14.3 (treat the installing machine as compromised) and docker-env v1.0.278 and v1.0.280. Check the maintainer's current release before re-pinning; outlets disagree on the clean version of neuronai-studio.

- Cut what a workflow can take: least-privilege permissions: on every workflow, OIDC roles scoped to one repository and branch, no long-lived cloud keys in Actions secrets, and required reviews that a bot account cannot satisfy alone. Our [GitHub CI secret hardening](/tools/github-ci-secret-hardening) tool walks through it.

## FAQ

### What is the wfx-loot campaign?

wfx-loot is Aikido Security's name for a campaign that began around 12:45 UTC on 10 November 2026. Using 4,837 compromised GitHub accounts, the attacker opened "docs: dependency audit notes" pull requests in 61,764 repositories to test write access, then injected a CI secret stealer where it could, and deleted the workflow runs afterwards.

### How do I know if my repository was hit by wfx-loot?

Aikido says to look, from 10 November on, for a wfx-docs branch, a "docs: dependency audit notes" pull request, commits titled "ci: refresh build cache", "chore: add ci helper" or "chore: add dependency audit workflow", short-lived chore/ branches, and above all missing workflow run numbers around those commits, because the attacker deletes the runs. No wfx artifacts does not mean nothing was taken.

### What should I rotate after wfx-loot?

If the payload ran, Aikido says to treat every secret and cloud role available to that repository's workflows as compromised and rotate them. Also look for AWS role trust policies opened to any AWS account and Azure federated identity credentials named wfx-ci-, and remove them: both survive secret rotation. If a probe pull request came from your account, treat the account as compromised.

### Was GitHub hacked?

No GitHub vulnerability or breach has been reported. The attacker used already-compromised user accounts and their tokens; StepSecurity, as cited by the Cloud Security Alliance, says the attack exploits no flaw in GitHub Actions itself. How the accounts were compromised is not known, and GitHub had made no public statement by 13 November.

### Which packages carried the wfx-loot payload?

Aikido names Packagist digitalelvis/neuronai-studio 3.14.3 and the Go module github.com/onuragtas/docker-env v1.0.278 and v1.0.280. Aikido says to treat any machine that installed the Packagist version as compromised. For the Go module the payload sits only in a workflow file, which Go builds do not run, but Aikido still recommends removing those versions.

### Is wfx-loot the same as GhostAction?

Aikido says no. Accounts hit by GhostAction in October 2026 were much more likely to be hit by wfx-loot, and in more than 100 repositories wfx-loot was injected into GhostAction workflow files, but Aikido assesses them as distinct campaigns likely run by different actors because the infrastructure, tooling and tradecraft differ.

## Sources

- [Aikido Security: wfx-loot campaign pushes CI secret stealer to tens of thousands of repositories](https://www.aikido.dev/blog/compromised-github-accounts-push-ci-secret-stealer-to-tens-of-thousands-of-repositories) (12 Nov; primary; read)

- [Endor Labs: GitHub Actions supply chain attack targeting CI secrets at scale](https://www.endorlabs.com/learn/github-actions-supply-chain-attack-targeting-ci-secrets-at-scale) (Nextcloud, WebdriverIO timeline; read)

- [Cloud Security Alliance: research note on the wfx CI secret stealer](https://labs.cloudsecurityalliance.org/research/csa-research-note-wfx-github-ci-secret-stealer-20261112-csa/) (cites StepSecurity; read)

- [The Hacker News: 4,837 hijacked GitHub accounts ran CI secret stealer](https://thehackernews.com/2026/11/4837-hijacked-github-accounts-ran-ci.html) (cites SafeDep; read)

- BleepingComputer: "Hackers compromise 4,800 GitHub accounts to steal cloud credentials" (12 Nov; read; source of the Fortune 100, GSA and French government list)

- StepSecurity's and SafeDep's own write-ups were seen only as cited by the Cloud Security Alliance and The Hacker News.

**Share:** #GitHubActions #SupplyChainSecurity #CICD #DevSecOps #Cybersecurity #Infosec #CloudSecurity #SecretsManagement

*This article is general information, not legal or security advice.*