---
title: 4,837 hijacked GitHub accounts pushed a CI secret stealer into repos they could write to; it ran in 1,800+ repos and deletes its own workflow runs | ctxsec
url: https://ctxsec.com/items/wfx-loot-hijacked-github-accounts-ci-secret-stealer-61k-repos-1800-ran-nov-10
description: "Aikido says that since Nov 10 (about 12:45 UTC) an attacker has used stolen credentials for 4,837 GitHub accounts to open probe pull requests titled 'docs: dependency audit notes' from a wfx-docs branch in 61,764 repositories, including 10,431 repos the account didn't own but could reach through collaborator or org access. Where it could, the attacker then pushed a roughly 1,500-line shell stealer ('wfx') via a modified workflow, a postinstall hook or a throwaway workflow branch, reverted within a minute and deleted the workflow run and logs. Aikido counts at least 1,806 to 1,835 repositories where the payload ran. The stealer takes Actions secrets and variables, GITHUB_TOKEN, OIDC tokens, runner process memory, cloud, registry, SSH and AI-tool credentials, then mints cloud sessions via OIDC, rewrites an AWS role trust policy to Principal '*', adds federated credentials to Azure AD apps and forges required status checks. It reached at least one Packagist package and one Go module through automated publishing."
status: "vendor research (Aikido Security, Nov 12, 2026), corroborated by Endor Labs, StepSecurity and SafeDep; counts are Aikido's from public GitHub data and may understate private-repo impact"
published: 2026-11-12
---

> Aikido says that since Nov 10 (about 12:45 UTC) an attacker has used stolen credentials for 4,837 GitHub accounts to open probe pull requests titled 'docs: dependency audit notes' from a wfx-docs branch in 61,764 repositories, including 10,431 repos the account didn't own but could reach through collaborator or org access. Where it could, the attacker then pushed a roughly 1,500-line shell stealer ('wfx') via a modified workflow, a postinstall hook or a throwaway workflow branch, reverted within a minute and deleted the workflow run and logs. Aikido counts at least 1,806 to 1,835 repositories where the payload ran. The stealer takes Actions secrets and variables, GITHUB_TOKEN, OIDC tokens, runner process memory, cloud, registry, SSH and AI-tool credentials, then mints cloud sessions via OIDC, rewrites an AWS role trust policy to Principal '*', adds federated credentials to Azure AD apps and forges required status checks. It reached at least one Packagist package and one Go module through automated publishing.

[← Cybersecurity News](/news) · [markdown](/items/wfx-loot-hijacked-github-accounts-ci-secret-stealer-61k-repos-1800-ran-nov-10.md)

vendor research (Aikido Security, Nov 12, 2026), corroborated by Endor Labs, StepSecurity and SafeDep; counts are Aikido's from public GitHub data and may understate private-repo impact

2026-11-12 7:40 AM ET

### 4,837 hijacked GitHub accounts pushed a CI secret stealer into repos they could write to; it ran in 1,800+ repos and deletes its own workflow runs

- **Still running:** The Hacker News found new probe PRs from wfx-docs branches opened 05:04-05:38 UTC Nov 12; StepSecurity counted about 63,000 probe PRs on Nov 12 with new ones minutes old. Aikido says 92% of the probe PRs are still open, suggesting most owners haven't noticed.
- **An open probe PR means the account is compromised**, even if no payload followed. A missing workflow run number right after an attacker commit is the most reliable sign the stealer ran.
- **Persistence survives rotation:** check AWS roles for a trust policy of `"Principal": {"AWS": "*"}`, IAM users for new access keys, and Azure AD apps for federated identity credentials named `wfx-ci-…` pointing at the compromised repo.
- **Packages named so far:** Packagist `digitalelvis/neuronai-studio` 3.14.3; Go `github.com/onuragtas/docker-env` v1.0.278 and v1.0.280 (payload in a workflow file only).
- **AI angle:** the stealer specifically harvests OpenAI, Anthropic/Claude, Gemini, Hugging Face, Cursor, Copilot, Codex and other AI tool tokens from runners.
- **Related, per Aikido:** accounts hit by October's GhostAction wave were more likely to be hit again, but Aikido assesses these are different actors.
- See the hunt item and playbook.

Sources: [Aikido Security: wfx-loot campaign pushes CI secret stealer to tens of thousands of repositories (Nov 12, 2026)](https://www.aikido.dev/blog/compromised-github-accounts-push-ci-secret-stealer-to-tens-of-thousands-of-repositories) · [Endor Labs: Hijacked GitHub Accounts Push 'wfx' CI Secret Stealer to Thousands of Repositories](https://www.endorlabs.com/learn/github-actions-supply-chain-attack-targeting-ci-secrets-at-scale) · [StepSecurity: WFX Phantom, the GitHub Actions Secret Stealer That Deletes Its Tracks](https://www.stepsecurity.io/blog/wfx-phantom-the-github-actions-secret-stealer) · [SafeDep: wfx GitHub Actions credential stealer](https://safedep.io/blog/github-actions-wfx-credential-stealer) · [The Hacker News: Attacker Used 4,837 Hijacked GitHub Accounts to Run a CI Secret Stealer in 1,806+ Repositories (Nov 12, 2026)](https://thehackernews.com/2026/11/4837-hijacked-github-accounts-ran-ci.html)