Stolen Logins for 4,837 GitHub Accounts Used to Run Secret Stealer in at Least 1,806 Repositories, Researchers Say

An attacker using stolen credentials for 4,837 GitHub accounts has been planting a secret-stealing payload in code repositories since Tuesday, Nov. 10, according to Aikido Security. The company is tracking the campaign as "wfx-loot," after the attacker's own name for the malware and for the secrets it takes.

The target is the machinery that builds and ships software. The payload goes after the secrets and cloud credentials that a repository's CI workflows can reach.

How the attack works

Every intrusion starts with a probe. The attacker opens a pull request titled "docs: dependency audit notes" from a branch named wfx-docs. If it lands, the stolen account has write access.

Aikido counted 61,839 of those pull requests between 12:45 UTC on Nov. 10 and 15:00 UTC on Nov. 11. They hit 61,764 repositories. Of the pull requests, 10,431 went into repositories the compromised account does not own, reached through collaborator or organization access. About 92% were still open when Aikido checked.

The real payload follows in a subset of those repositories. It comes in one of three forms, per Aikido:

• A commit titled "ci: refresh build cache" that adds roughly 1,500 lines to an existing workflow.
• A commit titled "chore: add ci helper" that adds a hidden script and an npm postinstall hook.
• A commit titled "chore: add dependency audit workflow" on a throwaway branch named chore/ plus eight random characters.

Then comes the cleanup. The attacker usually reverts the change within a minute and deletes the workflow run and its logs. A missing run number in the workflow history is often the only trace left.

The numbers

Aikido says the payload ran in at least 1,806 repositories. A later summary on the company's own post cites 1,835. The company says the true figure may be higher because the logs were deleted.

SafeDep, another supply chain security firm, ran a separate count. It found 8,093 repositories that received malicious commits starting at 12:46 UTC Tuesday. Of those, 7,309 had the stealer added to an existing workflow and 771 got the npm postinstall hook, which also runs on a developer's machine during npm install. SafeDep searched only the default branches of public repositories, so it says the real total is higher.

That count includes every repository that received malicious commits, not only the ones where the stealer ran.

Both firms sell security products. Their figures cover only public repositories they could see.

What gets taken

According to Aikido's technical analysis, the script collects GitHub Actions secrets and variables, the workflow GITHUB_TOKEN, OIDC and Actions runtime tokens, and keys for AI services including OpenAI, Anthropic and Hugging Face. It also reads the memory of running processes for tokens and pulls credential files for AWS, Azure, Google Cloud, Kubernetes, npm, PyPI and SSH.

It copies the repository, its last 100 commits and recent workflow artifacts. On self-hosted runners, it also reaches cloud credentials through instance metadata, Docker container state and systemd units.

Data goes out by HTTP POST to attacker-controlled servers. Aikido lists 194.150.166[.]244:8080/exfil and 18.143.168[.]96:8080/exfil as indicators. SafeDep found some commits that used Telegram only, about one-fifth of a 200-commit sample.

The script also has persistence features. Aikido says it can exchange GitHub OIDC tokens for AWS, Google Cloud and Azure sessions, modify AWS trust policies and insert Azure federated identity credentials. Those could preserve access after ordinary secret rotation.

Packages and downstream risk

At least 50 of the compromised users publish packages on npm, Go, Packagist, PyPI or crates, per Aikido. The payload reached at least one Packagist package, digitalelvis/neuronai-studio version 3.14.3, and one Go module through automated publishing triggers.

The Go tags carry the payload only in a workflow file. Go builds never execute workflow files, so consumers may be unaffected, Aikido says. It still recommends removal.

Aikido says the attacker appears to want CI secrets, not a wide supply chain spread.

Link to October activity

The campaign overlaps with earlier credential-theft activity. Aikido found that accounts hit in October were about a thousand times more likely than other active accounts to be used this month. In more than 100 repositories, the new payload was added to old October workflow files.

Aikido does not tie the two waves to one actor, citing differences in tools, servers and methods, and noting that stolen credentials often pass between groups.

The October wave resembles GhostAction, a campaign GitGuardian discovered in September 2025. Socket researchers reported that on Oct. 8, 2026, two GitHub accounts, henrywoo and kitao, pushed a malicious workflow named security-audit.yml to hundreds of repositories they could modify, sending stolen credentials to a server at 193.32.204[.]199. Socket said it expanded on earlier versions by also searching repository files and full Git history for credentials.

What owners are told to do

Aikido says any account that opened one of the test pull requests should be treated as compromised, even if the stealer never ran. Where the payload ran, every secret and cloud role available to the workflows should be treated as compromised.

SafeDep's researchers advise affected owners to revoke the commit author's tokens, OAuth app grants, SSH keys and sessions, and to turn on two-factor authentication. They also advise rotating every secret and variable the repository can read. Anyone who ran npm install on an affected commit should treat that machine as compromised and rotate its keys.

A clean-looking repository proves nothing. The attacker deletes logs, and the stealer's cache, artifact and step-summary channels are switched off, so the absence of wfx-loot artifacts does not show that data is safe. Owners should check Azure for unexpected federated credentials, AWS for open trust policies, and workflow histories for gaps in run numbers.

Still unresolved

The campaign is not over. The Hacker News found more pull requests with the same title opened early today, Nov. 12, between 05:04 and 05:38 UTC, after Aikido's own GitHub search ended on Wednesday. Three it checked came from wfx-docs branches. Whether the stealer followed is not known.

Aikido's analysis does not explain how the attacker obtained credentials for 4,837 accounts in the first place. Until that is answered, it is unclear whether more accounts are at risk.