4,837 stolen GitHub accounts were used to test and, in many cases, deploy a CI secret stealer into thousands of repositories, researchers say — and at least 1,806 repositories ran that stealer and likely had secrets exfiltrated.
Scale of the intrusion: accounts, tests, and repositories
Researchers from Aikido Security reported that beginning Tuesday an attacker opened test pull requests from 4,837 compromised GitHub accounts. Those test pull requests — all titled "docs: dependency audit notes" and opened from branches named wfx-docs — were submitted to 61,764 repositories to check whether the account could write to each repo. According to SafeDep, a separate analysis that looked at default branches of public repositories, 8,093 repositories received malicious commits between 12:46 UTC on Tuesday and 04:36 UTC today; SafeDep cautions the true total is higher because its search covered only public default branches.
How the attack worked: wfx-docs pull requests, workflow injections, and quick reversions
The attacker used a consistent initial pattern: a pull request with the title "docs: dependency audit notes" from a wfx-docs branch. Where the account could write, the attacker pushed a secret-stealing step into CI workflows. Aikido found the stealer ran in at least 1,806 repositories. In most repositories the malicious change was reverted within minutes, and where the stealer ran its logs were deleted — often along with the run itself. A correction published November 12, 2026 clarifies that researchers later found a third exfiltration server, a Telegram channel, and examples where changes remained longer than a minute.
- Common branch names: wfx-docs; chore/[a-z0-9]{8} (short-lived); ci-check-[0-9]{4}.
- Common commit messages: "ci: refresh build cache" (adds ~1,500 lines to a workflow); "chore: add ci helper" (adds a.ci-xxxxxx.sh and an apostinstall hook in package.json); "chore: add dependency audit workflow" (adds .github/workflows/build-audit-xxxxxx.yml); "chore: initial commit"; "ci: restore"; "ci: cleanup".
- Indicators of a run: missing run number on the attacker’s commit is a more reliable sign the stealer executed than presence of wfx-loot artifacts, the researchers warn.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildWhat the stealer took and how it pivots: CI secrets, cloud tokens, and durable backdoors
SafeDep’s analysis shows the stealer is built to harvest credentials from every source accessible to a runner: GitHub Actions secrets and variables, the workflow GITHUB_TOKEN, OIDC and Actions runtime tokens, AI-service keys, and credentials in process memory. It reads credential files for AWS, Azure, GCP, Kubernetes, npm, PyPI, SSH and other tools from their usual locations, and copies the repository plus its last 100 commits and recent workflow artifacts.
Beyond immediate exfiltration, the stealer is designed to use harvested tokens to gain deeper, long-lived access. It exchanges GitHub OIDC tokens for AWS, GCP and Azure sessions; on AWS it can create long-lived IAM access keys and rewrite an AWS role's trust policy to open the role to any AWS account. On Azure it can add federated identity credentials prefixed wfx-ci- to applications so workflows can sign in without stored secrets even after token rotation.
- Exfiltration endpoints and fingerprints: SHA-256 of stealer script 89695abb392d5cfd4972672961e644bb46baa98aa1ed7173c2a2816c762735cf; IPs 194.150.166[.]244:8080/exfil, 18.143.168[.]96:8080/exfil, and 153.75.82[.]159:8080; and a Telegram channel used in roughly one-fifth of sampled payloads.
- On self-hosted runners, the stealer also reads instance metadata, Docker container state and systemd units.
Affected packages, modules, and bot tokens
The stealer reached package ecosystems in multiple ways. Version 3.14.3 of the Packagist package digitalelvis/neuronai-studio was found malicious; SafeDep advises treating any machine that installed or opened it as compromised, blocking v3.14.3 and pinning v3.14.2 or earlier. Two Go module versions, github.com/onuragtas/docker-env v1.0.278 and v1.0.280, contained the stealer only inside a GitHub Actions workflow file (Go builds never execute workflow files), and researchers recommend removing those versions. Another Go module, github.com/vkuznet/gocurl, contains the stealer in pseudo-version v0.0.0-20261111095532-8d5aad0cb0da inside a workflow that has never run; users should block that pseudo-version.
The stealer also reached 28 WebdriverIO repositories via commits attributed to the bot account wdio-bot; no package releases were affected but the bot's token should be considered stolen. At least 50 compromised users appear to publish packages to npm, Go, Packagist, PyPI, or crates; researchers say the attacker seems focused on harvesting CI secrets rather than propagating via packages.
What this means for repository owners, package consumers, and CI teams
- Repository owners: Aikido warns that any account that opened one of the attacker’s test pull requests is compromised even if the stealer never ran. SafeDep advises revoking the commit author's tokens, OAuth app grants, SSH keys and sessions, enabling two-factor authentication, and rotating every secret and variable the repository can read.
- Package consumers and developers: Anyone who ran npm install on an affected commit or executed the malicious Packagist package inside vendor directories should treat their machine as compromised and rotate keys; block digitalelvis/neuronai-studio v3.14.3 and pin to v3.14.2 or earlier.
- CI and cloud teams: Check for Entra ID federated credentials named wfx-ci-* that you did not create; AWS CloudTrail events for AssumeRoleWithWebIdentity or AssumeRole sessions named wfx-* followed by CreateAccessKey or UpdateAssumeRolePolicy; GCP GenerateAccessToken and SignJwt calls from your GitHub workload identity pool; and Vault JWT logins from the GitHub OIDC issuer.
Researchers note overlap between accounts used this week and those targeted in the GhostAction October wave: accounts hit in October were roughly 1,000 times more likely than other active accounts to be reused in this campaign, and in over 100 repositories the new stealer was added to October’s workflow files while the older exfiltration step remained. Aikido cautioned, "we don't attribute November to the same actor at this stage," pointing to differences in infrastructure, tools and methods and the fact that stolen credentials can be redistributed.
The intrusion is both broad and surgical: wide initial probing with thousands of test pull requests, and targeted harvesting where write access existed. For repositories and projects that found a wfx-docs pull request, the researchers’ indicators and the specific fingerprints above provide a narrow checklist — but the fundamental lesson from the incident is stark and simple: treat any repository-writable account that interacted with these tests as compromised, and assume secrets accessible to workflows may already be in adversary hands.
