News Application Security
wfx-loot campaign turns hijacked GitHub accounts into a CI secret-stealing engine
An attacker used thousands of stolen GitHub credentials to push a shell script into Actions workflows, CI scripts and npm hooks. Aikido Security says it ran and exfiltrated secrets in more than 1,800 repositories, and the campaign is still active.
Key takeaways
- Stolen GitHub credentials, not a platform bug, let the attacker push a CI secret stealer into thousands of repositories.
- The wfx script steals Actions secrets, OIDC tokens and cloud credential files, then persists via AWS trust policies and Azure federated credentials.
- Repository counts differ by vendor: Aikido, SafeDep and Endor Labs each report their own number.
- Rotating secrets is not enough; remove the trust-policy and federated-credential persistence too.
- Hunt for the exact PR title, branch name and commit messages, and for gaps in workflow run numbers.
Starting November 10, an attacker holding stolen credentials for thousands of GitHub accounts began opening probe pull requests titled "docs: dependency audit notes" from a branch named wfx-docs. Aikido Security, which disclosed the campaign, puts the count at 4,837 compromised accounts and 61,764 targeted repositories. Those are vendor figures.
The payload is a single unobfuscated shell script of roughly 1,500 lines that labels itself wfx, analysed by Endor Labs and OX Security. The attacker drops it into GitHub Actions workflows, CI shell scripts and npm postinstall hooks under commit messages such as "ci: refresh build cache", "chore: add ci helper" and "chore: add dependency audit workflow". Once it has run, a follow-up commit labelled "ci: restore" or "ci: cleanup" reverts the change, and the workflow run and its logs are deleted.
What the stealer takes #
The script harvests Actions secrets and variables, the GITHUB_TOKEN, OIDC tokens, and credential files for AWS, Azure, GCP, Docker, Kubernetes, npm, PyPI, SSH, GPG, Vault and Terraform, plus AI provider keys. It exchanges OIDC tokens for AWS, GCP and Azure sessions. Then it persists. Aikido and Endor Labs report rewritten AWS role trust policies that allow any AWS principal, Azure federated credentials named with a wfx-ci prefix, and forged success status checks used to bypass branch protection.
Early copies posted stolen data over HTTP to port 8080 at a path named /exfil. OX Security reports that from early on November 12 new copies switched to Telegram bots.
How far it reached #
The counts differ by vendor and should not be merged. Aikido says the payload ran and credentials were exfiltrated in at least 1,806 repositories, a figure it later revised to at least 1,835. SafeDep counted 8,093 public repositories that received malicious commits on default branches, most through workflow injection. OX Security and The Hacker News report that 28 WebdriverIO repositories received commits through the wdio-bot account on November 11; the commits to the main webdriverio repository were spotted and reverted within about 20 minutes.
At least 50 of the hijacked accounts publish to npm, Go, Packagist, PyPI or crates.io, per Aikido, and compromised releases of the Packagist package digitalelvis/neuronai-studio and the Go module github.com/onuragtas/docker-env are already known. A follow-on wave of malicious package publishes remains possible.
The initial access vector is unconfirmed. All reporting points to stolen credentials, not a GitHub platform vulnerability. Aikido assesses the campaign as distinct from October's GhostAction wave and likely run by a different actor.
What to do now #
- Hunt for the PR title, the wfx-docs branch and the commit messages above across every repository since November 10, including repositories where your accounts are only collaborators.
- Treat every secret reachable by an affected workflow as compromised. Rotate, then remove the persistence in AWS role trust policies and Azure federated credentials, because rotation alone does not evict the attacker.
- Look for gaps in workflow run numbers. Deleted runs leave holes.
- Harden: code-owner review on workflow files, a read-only default GITHUB_TOKEN, OIDC trust scoped to specific repositories and branches, and npm ci with --ignore-scripts in CI.
Sources
- wfx-loot campaign pushes CI secret stealer to tens of thousands of repositories, Aikido Security
- Hijacked GitHub Accounts Push “wfx” CI Secret Stealer to Thousands of Repositories, Endor Labs
- Thousands Of GitHub Accounts Hijacked With wfx-loot CI Secret Stealing Malware Via GitHub Actions & npm, OX Security
- Attacker Used 4,837 Hijacked GitHub Accounts to Run a CI Secret Stealer in 1,806+ Repositories, The Hacker News
Questions this raises
- Was GitHub itself breached?
- No source reports a GitHub platform vulnerability. The attacker used stolen credentials for existing accounts, and the initial access vector for those credentials is unconfirmed.
- My workflow ran the wfx script. Is rotating secrets enough?
- No. Aikido and Endor Labs report the script rewrites AWS role trust policies to allow any principal and adds Azure federated credentials with a wfx-ci prefix. Remove those, then rotate.
- How do I know if the script ran, given the attacker deletes the run and logs?
- Look for gaps in workflow run numbers, revert commits labelled ci: restore or ci: cleanup, and the probe PR titled docs: dependency audit notes from a wfx-docs branch.