Tens of thousands of GitHub repositories have been targeted in a campaign dubbed “wfx-loot” that uses malicious workflows to steal GitHub stock secrets and cloud credentials.
Although not all repositories executed the payload, researchers confirmed that the threat actor stole the secrets of at least 1,835 targets.
The threat actor used thousands of compromised GitHub accounts to open pull requests on repositories that those accounts could access, testing whether they had sufficient write permissions to inject malicious code.
Some of the compromised accounts belonged to Fortune 100 organizations, the US General Services Administration, the French government, Nextcloud, and WebdriverIO.
According to researchers at application security firm Aikido, about 50 of them appear to have publishing rights to other open source software ecosystems and package indexes such as npm, PyPI, Go, crates and Packagist.
Attack details
Aikido says the wfx-loot campaign began around 12:45 UTC on November 10, when the attacker used stolen GitHub credentials from 4,837 compromised accounts to probe 61,764 repositories to gain write access.
The threat actor opened pull requests titled “docs: dependency audit notes,” disguised as dependency audit notes.
Of these pull requests, 92% remain open, Aikido reports, suggesting that the repository’s rightful owners have not noticed the activity.
Source: Aikido
They then delivered a 1,500-line credential-stealing shell script by modifying an existing GitHub Actions workflow, adding a new workflow on an ephemeral branch, or implementing an npm install hook.
The script attempts to collect the following data:
- GitHub Actions and Variables, GITHUB_TOKEN Execution Tokens, OIDC, and Workflow Actions.
- Cloud credentials for AWS, Azure, and Google Cloud, including credentials exposed via instance metadata on self-hosted executors.
- Developer and infrastructure credentials from Git, SSH, GPG, Docker, Kubernetes, npm, PyPI, Vault, and Terraform.
- AI service credentials and developer tools for OpenAI, Anthropic, Gemini, Hugging Face, Cursor, and GitHub Copilot.
- Other sources of secrets include environment variables, .env files, private keys, keystores, shell histories, process memory, repository files and recent commits, and workflow artifacts.
The script also supports cloud privilege escalation by exchanging GitHub OIDC tokens for temporary AWS, Azure, and GCP cloud sessions.
In AWS, it can chain to additional IAM (identity and access management) roles in the repository “to create long-term credentials for IAM users.” It also uses the collected service account credentials to impersonate GCP.
Aikido notes These capabilities include establishing persistent access by creating long-lived credentials or modifying cloud identity and trust policies where permissions allow.
The script compressed the collected data into tar archives and exfiltrated it via HTTP POST to one of two endpoints controlled by the attacker.
In the final step, the attacker quickly reverted their changes and deleted executions and workflow logs. Aikido says it was finished in less than a minute.
The automated release pushed the payload into Packagist’s digitalelvis/neuronai-studio 3.14.3 and into two versions of the Go module github.com/onuragtas/docker-env, v1.0.278 and v1.0.280.
Researchers believe the threat actor’s primary goal was to steal CI secrets, while the release of the packages was a byproduct of the automated release.
The researchers also found some overlap with the GhostAction 2025 campaign.
Repository owners are advised to look for the “wfx-docs” branch, probe pull request, and gaps in the workflow execution numbers.
When payload execution is confirmed, all secrets and cloud roles available for affected workflows should be considered compromised and alternated immediately.
Adaptive Security’s AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.
See what’s happening with a 14-day read-only scan of Microsoft 365 or Google Workspace, without MX modifications.
