wfx-loot Campaign Compromises 4,837 GitHub Accounts to Steal Cloud Keys

The wfx-loot campaign used stolen GitHub credentials to probe write access across more than 61,000 repositories, inject malware into CI workflows, and harvest access secrets. The report published on November 12, 2026 describes a large-scale incident posing direct risks to GitHub Actions, cloud infrastructure, and the software supply chain.

What is wfx-loot?

Aikido Security named the campaign wfx-loot based on traces in the malware and the term used by the attacker for stolen data. The activity began at around 12:45 UTC on November 10, 2026, using credentials from 4,837 GitHub accounts to open probe pull requests across 61,764 repositories.

At least 1,835 targets were confirmed to have exposed secrets. Around 50 compromised accounts also had publishing rights on npm, PyPI, Go, crates, and Packagist, extending the risk beyond individual repositories.

How did the attack chain work?

The attacker first created a wfx-docs branch and a pull request titled docs: dependency audit notes to confirm write access. With sufficient permission, they modified an existing workflow, added a workflow on a short-lived branch, or planted an npm postinstall hook.

The payload is a shell script of about 1,500 lines. After execution, the malware quickly reverted changes and deleted workflow history and logs in under a minute, leaving gaps in run numbering as one of the few remaining clues.

Which secrets could be stolen?

Targets included GitHub Actions secrets, GITHUB_TOKEN, OIDC tokens, environment variables, SSH keys, and credentials for AWS, Azure, Google Cloud, Docker, Kubernetes, Vault, and Terraform. The malware also searched for keys belonging to AI services and developer tools such as OpenAI, Anthropic, Gemini, Hugging Face, Cursor, and GitHub Copilot.

On self-hosted runners, the payload could read credentials from virtual-machine metadata services, process memory, shell history, configuration files, and recent commits. Collected data was compressed and sent by HTTP POST to attacker-controlled infrastructure.

Cloud privilege-escalation risk

wfx-loot went beyond collecting keys. It could exchange OIDC tokens for AWS, Azure, or GCP sessions, chain IAM roles, impersonate service accounts, and access secret stores. Where permissions allowed, it could create long-lived keys or alter trust policies to retain access after token rotation.

Impact on the software supply chain

Automated publishing carried the payload into Packagist package digitalelvis/neuronai-studio 3.14.3 và workflow của hai phiên bản module Go github.com/onuragtas/docker-env. Aikido assessed that CI secrets remained the main objective, but the unintended spread shows how one compromised developer account can affect several ecosystems.

Key indicators to review

• A wfx-docs branch or branches matching chore/xxxxxxxx.
• A pull request titled docs: dependency audit notes.
• Commits such as ci: refresh build cache or chore: add ci helper.
• Unexplained gaps in workflow-run numbering.
• Connections to 194.150.166[.]244:8080 or 18.143.168[.]96:8080.

What should organizations do now?

Repository owners should review branches, pull requests, commits, and workflow history from November 10 onward. If the payload ran, every secret and cloud role available to the workflow should be treated as compromised and revoked or rotated, while teams investigate newly created long-lived keys, IAM policies, and federated identities.

Longer term, organizations should restrict default workflow permissions, separate runners by trust level, protect branches, require approval for CI changes, and monitor package-publishing behavior. Short-lived secrets and least privilege substantially reduce the blast radius of a compromised developer account.

Lessons from the wfx-loot campaign

The incident shows that GitHub accounts and CI/CD pipelines are part of the infrastructure control plane, not merely development tools. A write-capable token can provide a path from source code to cloud platforms, package registries, and production; identity controls, immutable logging, and rapid secret rotation must therefore be core capabilities.

VNCyberS compiled from Aikido Security and BleepingComputer