4,837 hijacked GitHub accounts pushed a CI secret stealer into repos they could write to; it ran in 1,800+ repos and deletes its own workflow runs
- Still running: The Hacker News found new probe PRs from wfx-docs branches opened 05:04-05:38 UTC Nov 12; StepSecurity counted about 63,000 probe PRs on Nov 12 with new ones minutes old. Aikido says 92% of the probe PRs are still open, suggesting most owners haven't noticed.
- An open probe PR means the account is compromised, even if no payload followed. A missing workflow run number right after an attacker commit is the most reliable sign the stealer ran.
- Persistence survives rotation: check AWS roles for a trust policy of
"Principal": {"AWS": "*"}, IAM users for new access keys, and Azure AD apps for federated identity credentials namedwfx-ci-…pointing at the compromised repo. - Packages named so far: Packagist
digitalelvis/neuronai-studio3.14.3; Gogithub.com/onuragtas/docker-envv1.0.278 and v1.0.280 (payload in a workflow file only). - AI angle: the stealer specifically harvests OpenAI, Anthropic/Claude, Gemini, Hugging Face, Cursor, Copilot, Codex and other AI tool tokens from runners.
- Related, per Aikido: accounts hit by October's GhostAction wave were more likely to be hit again, but Aikido assesses these are different actors.
- See the hunt item and playbook.
Sources: Aikido Security: wfx-loot campaign pushes CI secret stealer to tens of thousands of repositories (Nov 12, 2026) · Endor Labs: Hijacked GitHub Accounts Push 'wfx' CI Secret Stealer to Thousands of Repositories · StepSecurity: WFX Phantom, the GitHub Actions Secret Stealer That Deletes Its Tracks · SafeDep: wfx GitHub Actions credential stealer · The Hacker News: Attacker Used 4,837 Hijacked GitHub Accounts to Run a CI Secret Stealer in 1,806+ Repositories (Nov 12, 2026)