[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Threat Hunting · markdown

vendor research (Aikido Security IOCs, Nov 12, 2026; StepSecurity and The Hacker News for additional commit/IP indicators)

Hunt: wfx-loot GitHub CI stealer, wfx-docs probe PRs, 'ci: refresh build cache' commits, missing run numbers and cloud backdoors

  • GitHub (from Nov 10 on): branches wfx-docs, short-lived chore/[a-z0-9]{8}, ci-check-[0-9]{4}; PR title docs: dependency audit notes (body 'Routine dependency audit notes', adds docs/wfx-audit.md); commits ci: refresh build cache, chore: add ci helper, chore: add dependency audit workflow, chore: initial commit before a new workflow in an empty repo, ci: restore, ci: cleanup; files .ci-xxxxxx.sh with a postinstall/build/test hook in package.json, .github/workflows/build-audit-xxxxxx.yml; workflow steps named like Restore cache j632 with WF_CALLBACK/WF_SECRETS env vars.
  • Audit log (query sketch): workflow-run deletions by the compromised user right after a push (GitHub audit log workflows.delete_workflow_run); commit statuses for your required check names posted by a user token instead of your CI app.
  • Network: 194.150.166[.]244:8080/exfil, 18.143.168[.]96:8080/exfil, 153.75.82[.]159:8080 (The Hacker News); stealer SHA-256 89695abb392d5cfd4972672961e644bb46baa98aa1ed7173c2a2816c762735cf.
  • AWS: CloudTrail UpdateAssumeRolePolicy setting Principal *, CreateAccessKey from GitHub-hosted runner IPs, AssumeRoleWithWebIdentity from the affected repo outside normal runs.
  • Azure / GCP: new federated identity credentials named wfx-ci-… on Entra apps; GCP generateAccessToken/signJwt on service accounts from runner IPs.
  • No artifacts doesn't mean no theft: in this campaign the cache, step-summary and wfx-loot- artifact channels were switched off for public repos, so absence of them proves nothing.
  • Overlap: GhostAction indicators (193.32.204[.]199, fake fa-solid-400.woff2, cron tagged #ghc2) on the same accounts.

Sources: Aikido Security: wfx-loot campaign pushes CI secret stealer to tens of thousands of repositories (Nov 12, 2026) · StepSecurity: WFX Phantom, the GitHub Actions Secret Stealer That Deletes Its Tracks · The Hacker News: Attacker Used 4,837 Hijacked GitHub Accounts to Run a CI Secret Stealer in 1,806+ Repositories (Nov 12, 2026)