Hackers Used 4,837 Stolen GitHub Accounts to Probe 61,000-Plus Repositories and Drain CI Secrets From More Than 1,800 of Them

A single attacker has turned thousands of stolen GitHub logins into a machine for harvesting the keys that run modern software companies. According to Aikido Security, a campaign it tracks as “wfx-loot” used 4,837 compromised GitHub accounts, starting November 10, to probe 61,764 repositories and push a credential stealer into the build pipelines of those it could write to. Aikido says the payload ran in at least 1,806 repositories, a figure its latest tally puts at 1,835, and that the credentials in those projects have likely already been taken.

The target was not source code or customer databases. It was CI/CD secrets: the cloud keys, deployment tokens and API credentials that automated build systems quietly hold so software can be tested, packaged and shipped without a human in the loop.

How the Attack Worked

Each attempt began with a harmless-looking test. The attacker opened a pull request titled “docs: dependency audit notes” from a branch called wfx-docs, simply to confirm that the stolen account could write to the repository. Aikido counted roughly 61,800 of these probe pull requests opened between November 10 and November 11, and 10,431 of them landed in repositories the hijacked accounts did not own, reached through collaborator or organization access. Aikido says 92% of those were still open when it checked, a sign that most owners had not noticed.

Where the probe worked, the attacker pushed the real payload, a roughly 1,500-line shell script, in one of three ways: injected into an existing GitHub Actions workflow under the commit message “ci: refresh build cache,” added as an npm postinstall hook that also fires on a developer’s own laptop during npm install, or dropped into a new workflow on a short-lived throwaway branch. The change was then reverted and the workflow run, along with its logs, deleted. Aikido notes that a missing run number in a repository’s workflow history is often the only trace left behind.

A second firm, SafeDep, counted 8,093 public repositories that received malicious commits between November 10 and early November 12, as reported by The Hacker News. In 7,309 of them the stealer was added to an existing workflow, and in 771 it arrived as an npm install hook. SafeDep’s search covered only the default branches of public repositories, so the real total is higher.

What the Stealer Takes, and Why Rotation May Not Be Enough

The script is built to sweep up every credential a build runner can reach: GitHub Actions secrets and variables, the workflow’s GITHUB_TOKEN, OIDC and runtime tokens, AI service keys, and secrets sitting in the memory of the runner’s own processes. It also reads standard credential files for AWS, Azure, Google Cloud, Kubernetes, npm, PyPI and SSH, and copies the repository along with its last 100 commits. On self-hosted runners, it pulls cloud credentials from instance metadata too.

The more worrying part is persistence. Researchers found the tool can trade GitHub OIDC tokens for live AWS, Google Cloud and Azure sessions, create long-lived AWS access keys, rewrite an AWS role’s trust policy to open it to any AWS account, and add federated credentials prefixed wfx-ci- to Azure AD applications. In plain terms, a company that rotates every token but misses those changes could leave the door open. Exfiltrated data went to attacker servers over HTTP or to a Telegram chat; in a sample of 200 payload commits, SafeDep found about a fifth used Telegram only.

Spillover Into the Software Supply Chain

Aikido says the attacker appears focused on stealing CI secrets rather than poisoning packages, but automated publishing pipelines carried the payload into a few anyway. Version 3.14.3 of the Packagist package digitalelvis/neuronai-studio is malicious, and two versions of a Go module carry the stealer in a workflow file. At least 50 of the compromised users appear to publish packages to ecosystems such as npm, Go, Packagist, PyPI or crates, and the stealer reached 28 WebdriverIO repositories through commits made as that project’s bot account. SecurityWeek also reported on the campaign’s scale.

Aikido found heavy overlap with October’s GhostAction wave, in which stolen GitHub accounts pushed secret-stealing workflows: accounts hit in October were about 1,000 times more likely than other active accounts to be used this week. Still, the firm says it does not attribute the November activity to the same actor, because the tools and infrastructure differ and stolen credentials often pass between several groups. None of the published analyses explain how the credentials were stolen in the first place.

Why It Matters for Business

For most companies, the build pipeline is now one of the most privileged systems they run, and one of the least watched. A single CI runner can hold the keys to production cloud accounts, package registries and paid AI services. This campaign shows how cheaply that access can be abused: one stolen developer login with write access to a shared repository is enough, and the attacker cleans up so fast that ordinary log review may show nothing.

The financial stakes are concrete. Stolen cloud keys can be used to spin up computing resources on the victim’s bill, steal data or move deeper into production systems, and stolen AI keys have become a target in their own right. Companies that rely on outside contributors, contractors or open-source dependencies inherit that risk even if their own staff are careful, because 10,431 of the probes arrived through collaborator and organization access rather than through a repository’s owner.

What Security Teams Should Do Now

• Search every repository you can write to for wfx-docs branches, pull requests titled “docs: dependency audit notes,” and commits such as “ci: refresh build cache” or “chore: add ci helper” from November 10 onward.
• If the payload ran, treat every secret and cloud role reachable by that repository’s workflows as compromised and rotate them, as Aikido advises.
• Revoke the commit author’s tokens, OAuth app grants, SSH keys and sessions, and require two-factor authentication, per SafeDep’s guidance.
• Check AWS CloudTrail for wfx-* role sessions followed by new access keys or trust policy changes, and look in Entra ID for unfamiliar wfx-ci-* federated credentials.
• Treat any machine that ran npm install on an affected commit as compromised, and block the malicious package versions named by researchers.

The Bottom Line

The wfx-loot campaign is a reminder that the shortest path into a company’s cloud often runs through its build system rather than its firewall. With thousands of accounts hijacked, more than 1,800 pipelines likely drained and persistence tricks designed to survive key rotation, the cleanup will take far longer than the attack did. Businesses that ship software should audit their CI permissions now, before the stolen keys get used.

Edited by Coron @QUE.COM
Website: https://QUE.COM Intelligence
Sponsored by: https://MAJ.COM AI Autonomous