Stolen GitHub tokens plant a CI secret-stealer across thousands of repos
Original title: Hackers Hijack 4,837 GitHub Accounts to Target 61,764 Repositories With CI Secret-Stealing Malware
Aikido says at least 1,806 repositories ran a “wfx” payload that stole Actions secrets and cloud keys from November 10.
A threat actor used stolen GitHub tokens starting November 10, 2026, to open probe pull requests and then plant a roughly 1,500-line shell script in workflows or npm postinstall hooks. The script collects Actions secrets, cloud keys, and AI-tool credentials, swaps OIDC tokens for cloud sessions, and posts data to two servers. Cleanup removes workflow runs within a minute. Aikido does not attribute this wave to the earlier GhostAction compromises.
Unconfirmed: Aikido does not link the October and November waves to one actor, and says the 1,806 count may be low.
- Aikido counted 4,837 hijacked accounts and 61,764 targeted repositories.
- GitHub search showed 61,839 probe pull requests, about 92 percent still open.
- Treat Packagist package digitalelvis/neuronai-studio 3.14.3 as hostile.
- Go module versions v1.0.278 and v1.0.280 carry the payload only in a workflow.
- Exfiltration used 194.150.166.244 and 18.143.168.96 on port 8080.
Impact: CI secrets, cloud keys, and AI credentials stolen
| Product | Affected |
|---|---|
| GitHub Actions | — |
- 1.Search for wfx-docs branches, the listed commit messages, and probe pull requests.
- 2.Rotate exposed workflow secrets and cloud roles, and revoke hijacked GitHub tokens.
- 3.Review logs for new federated credentials and changed AWS trust policies.
- ATT&CK
- T1078 Valid AccountsT1195.002 Compromise Software Supply ChainT1059.004 Unix ShellT1552.001 Credentials In FilesT1567 Exfiltration Over Web Service
- Vendors
- GitHub
- Products
- GitHub Actions
- Malware
- wfx
- Organizations
- Aikido
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 18.143.168.96 | 194.150.166[.]244:8080 (/exfil) Exfiltration server Network 18.143.168[.]96:8080 (/exfil) Exfiltration server GitHub branches wfx-doc |
| ipv4 | 194.150.166.244 | v1.0.278, v1.0.280 Payload in a workflow file only Network 194.150.166[.]244:8080 (/exfil) Exfiltration server Network 18.143.168[.]96 |
| sha256 | 89695abb392d5cfd4972672961e644bb46baa98aa1ed7173c2a2816c762735cf | pendency audit workflow Payload and cleanup commits SHA-256 89695abb392d5cfd4972672961e644bb46baa98aa1ed7173c2a2816c762735cf Stealer script Note: IP addresses and domains are intention |
From the original article
4 min read at cybersecuritynews.com
A threat actor has used stolen GitHub credentials to push a secret-stealing payload into tens of thousands of code repositories. The activity began on November 10, 2026, around 12:45 UTC. It aims at the secrets and cloud keys that sit inside GitHub Actions, the tool many teams use to build and ship code.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.