4,837 compromised GitHub accounts were used to probe 61,764 repositories and — according to researchers — steal secrets from at least 1,835 targets, Aikido reports.
Scope and timeline of the wfx-loot campaign
Researchers at application security company Aikido say the campaign, which they label "wfx-loot," began around 12:45 UTC on November 10. Using stolen GitHub credentials from 4,837 accounts, the actor opened a large number of probe pull requests across repositories those accounts could access. Aikido counted 61,764 repositories probed and confirmed that secrets were exfiltrated from at least 1,835 targets.
Most of the probe pull requests were titled "docs: dependency audit notes." According to Aikido, 92% of those pull requests remained open — a detail the researchers interpret as evidence many repository owners did not notice the activity.
How the attacker gained and removed access
The threat actor used the compromised accounts to test write permissions by opening pull requests and, where possible, to modify or add GitHub Actions workflows or plant npm install hooks. When the payload executed, the attacker typically reverted the changes and deleted workflow runs and logs in under a minute, minimizing visible traces of successful execution.
Aikido reports the actor compressed collected data into tarballs and exfiltrated it by HTTP POST to one of two attacker-controlled endpoints.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleThe payload: a 1,500-line credential-stealing shell script
Aikido describes the central payload as a roughly 1,500-line shell script that attempts to harvest a wide range of secrets and identity material. The script targets:
- GitHub Actions variables and runtime tokens, including the workflow's GITHUB_TOKEN and OIDC tokens.
- Cloud credentials for AWS, Azure, and Google Cloud, including credentials exposed via instance metadata on self-hosted runners.
- Developer and infrastructure credentials from Git, SSH, GPG, Docker, Kubernetes, npm, PyPI, Vault, and Terraform.
- AI service and developer-tool credentials for OpenAI, Anthropic, Gemini, Hugging Face, Cursor, and GitHub Copilot.
- Other secret sources such as environment files, private keys and keystores, shell histories, process memory, repository files and recent commits, and workflow artifacts.
The script also supports cloud privilege escalation. In AWS it can chain into additional IAM roles present in a repository and "create long-lived credentials for IAM users," and in GCP it can use collected service-account credentials to impersonate identities. Aikido notes the actor can establish persistent access where permissions permit by creating long-lived credentials or modifying cloud identity and trust policies.
Collateral: package ecosystems and named targets
Aikido found that some compromised GitHub accounts belonged to Fortune 100 organizations, the US General Services Administration, the French government, Nextcloud, and WebdriverIO. About 50 of the compromised accounts appear to have publishing rights on upstream package ecosystems and indexes such as npm, PyPI, Go, crates, and Packagist.
Automated publishing as part of the campaign carried the payload into third-party package releases: Packagist’s digitalelvis/neuronai-studio version 3.14.3 and two versions of the Go module github.com/onuragtas/docker-env, v1.0.278 and v1.0.280. Aikido says these package releases were likely a byproduct of the actor's automated publishing process rather than the primary objective.
The researchers also observed certain overlaps with the 2025 GhostAction campaign.
What repository owners should look for and do now
Aikido advises repository owners to search for telltale indicators of compromise: look for the "wfx-docs" branch, the probe pull request titled "docs: dependency audit notes," and unexpected gaps in workflow run numbering. Where payload execution is confirmed, Aikido recommends treating all secrets and cloud roles available to the affected workflows as compromised and rotating them immediately.
What this means for technologists and open-source maintainers
- Technologists and security teams should treat CI/CD credentials and OIDC tokens as high-value targets: the payload specifically aims to harvest those artifacts and to exchange OIDC tokens for cloud sessions in order to escalate privileges.
- Open-source maintainers and package registries should be alert for unexpected automated publishes and examine recent package releases for unauthorized changes: Aikido documented three published package versions that carried the payload.
The wfx-loot campaign underlines a simple, uncomfortable truth: a large-scale sweep of compromised developer accounts can turn routine collaboration mechanisms — pull requests, workflow edits, package publishing — into a highly efficient secret-harvesting operation. Where those workflows touch cloud accounts or package indexes, the consequences move quickly from ephemeral CI artifacts to long-lived credentials and cross-ecosystem contamination. Aikido's guidance is direct: find the "wfx-docs" probe, assume exposed secrets are already gone, and rotate what was accessible — fast.
Original reporting: https://www.bleepingcomputer.com/news/security/hackers-compromise-4-800-github-accounts-to-steal-cloud-credentials/
