wfx-loot campaign steals CI and cloud secrets via GitHub
Original title: Hackers compromise 4,800 GitHub accounts to steal cloud credentials
Aikido says secrets were taken from at least 1,835 targets after probes of 61,764 repositories.
Aikido says the wfx-loot campaign began around 12:45 UTC on November 10, using stolen credentials from 4,837 GitHub accounts to open pull requests titled "docs: dependency audit notes." Where write access existed, a roughly 1,500-line script harvested GitHub Actions, cloud, developer and AI-service secrets, then posted compressed data to attacker endpoints and deleted traces within a minute. Some compromised accounts belonged to Fortune 100 organizations, the US General Services Administration, the French government, Nextcloud and WebdriverIO. Automated publishing also put the payload into named Packagist and Go package versions.
Unconfirmed: Aikido believes package releases were a byproduct and notes overlaps with the 2025 GhostAction campaign.
- About 92% of the probe pull requests remained open, Aikido reports.
- Roughly 50 accounts appeared to have publishing rights on package indexes.
- Affected package versions include neuronai-studio 3.14.3 and docker-env v1.0.278 and v1.0.280.
- Owners should check for the wfx-docs branch and gaps in workflow run numbers.
- Confirmed executions require immediate rotation of workflow secrets and cloud roles.
Impact: Theft of CI secrets, cloud credentials and developer tokens
| Product | Affected |
|---|---|
| GitHub Actions | — |
- 1.Search for the wfx-docs branch, the probe pull request and gaps in workflow run numbers.
- 2.If payload execution is confirmed, rotate all secrets and cloud roles available to affected workflows.
- ATT&CK
- T1078 Valid AccountsT1528 Steal Application Access TokenT1552.001 Credentials In FilesT1195.002 Compromise Software Supply Chain
- Vendors
- GitHub
- Malware
- wfx-loot
- Organizations
- Aikido
- Countries
- United StatesFrance
From the original article
3 min read at bleepingcomputer.com
A new campaign dubbed 'wfx-loot' has unfolded on GitHub where threat actors used 4,837 compromised accounts to probe 61,764 repositories, open pull requests, and push secrets-stealing malware. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.