---
title: Hunt: wfx-loot GitHub CI stealer, wfx-docs probe PRs, 'ci: refresh build cache' commits, missing run numbers and cloud backdoors | ctxsec
url: https://ctxsec.com/items/hunt-wfx-loot-wfx-docs-probe-prs-missing-run-numbers-aws-trust-star-azure-wfx-ci-fic
description: "Indicators for the wfx-loot campaign. Look on GitHub first (branches, PRs, commits, gaps in workflow run numbers), then in the clouds those workflows could reach, because the stealer adds persistence meant to outlast token rotation."
status: "vendor research (Aikido Security IOCs, Nov 12, 2026; StepSecurity and The Hacker News for additional commit/IP indicators)"
published: 2026-11-12
---

> Indicators for the wfx-loot campaign. Look on GitHub first (branches, PRs, commits, gaps in workflow run numbers), then in the clouds those workflows could reach, because the stealer adds persistence meant to outlast token rotation.

[← Threat Hunting](/hunting) · [markdown](/items/hunt-wfx-loot-wfx-docs-probe-prs-missing-run-numbers-aws-trust-star-azure-wfx-ci-fic.md)

vendor research (Aikido Security IOCs, Nov 12, 2026; StepSecurity and The Hacker News for additional commit/IP indicators)

2026-11-12 7:40 AM ET

### Hunt: wfx-loot GitHub CI stealer, wfx-docs probe PRs, 'ci: refresh build cache' commits, missing run numbers and cloud backdoors

- **GitHub (from Nov 10 on):** branches `wfx-docs`, short-lived `chore/[a-z0-9]{8}`, `ci-check-[0-9]{4}`; PR title `docs: dependency audit notes` (body 'Routine dependency audit notes', adds `docs/wfx-audit.md`); commits `ci: refresh build cache`, `chore: add ci helper`, `chore: add dependency audit workflow`, `chore: initial commit` before a new workflow in an empty repo, `ci: restore`, `ci: cleanup`; files `.ci-xxxxxx.sh` with a `postinstall`/`build`/`test` hook in package.json, `.github/workflows/build-audit-xxxxxx.yml`; workflow steps named like `Restore cache j632` with `WF_CALLBACK`/`WF_SECRETS` env vars.
- **Audit log (query sketch):** workflow-run deletions by the compromised user right after a push (GitHub audit log `workflows.delete_workflow_run`); commit statuses for your required check names posted by a user token instead of your CI app.
- **Network:** `194.150.166[.]244:8080/exfil`, `18.143.168[.]96:8080/exfil`, `153.75.82[.]159:8080` (The Hacker News); stealer SHA-256 `89695abb392d5cfd4972672961e644bb46baa98aa1ed7173c2a2816c762735cf`.
- **AWS:** CloudTrail `UpdateAssumeRolePolicy` setting Principal `*`, `CreateAccessKey` from GitHub-hosted runner IPs, `AssumeRoleWithWebIdentity` from the affected repo outside normal runs.
- **Azure / GCP:** new federated identity credentials named `wfx-ci-…` on Entra apps; GCP `generateAccessToken`/`signJwt` on service accounts from runner IPs.
- **No artifacts doesn't mean no theft:** in this campaign the cache, step-summary and `wfx-loot-` artifact channels were switched off for public repos, so absence of them proves nothing.
- **Overlap:** GhostAction indicators (`193.32.204[.]199`, fake `fa-solid-400.woff2`, cron tagged `#ghc2`) on the same accounts.

Sources: [Aikido Security: wfx-loot campaign pushes CI secret stealer to tens of thousands of repositories (Nov 12, 2026)](https://www.aikido.dev/blog/compromised-github-accounts-push-ci-secret-stealer-to-tens-of-thousands-of-repositories) · [StepSecurity: WFX Phantom, the GitHub Actions Secret Stealer That Deletes Its Tracks](https://www.stepsecurity.io/blog/wfx-phantom-the-github-actions-secret-stealer) · [The Hacker News: Attacker Used 4,837 Hijacked GitHub Accounts to Run a CI Secret Stealer in 1,806+ Repositories (Nov 12, 2026)](https://thehackernews.com/2026/11/4837-hijacked-github-accounts-ran-ci.html)