Attackers have used stolen GitHub credentials to push a secret-stealing payload into tens of thousands of code repositories, security researchers at Aikido have reported. The campaign, tracked as wfx-loot, began at around 12:45 UTC on 10 November.

Aikido counted 4,837 compromised accounts opening probe pull requests across 61,764 repositories. In at least 1,806 of those repositories, the payload ran and credentials were sent to the attackers. Aikido says that figure is a lower bound, because the attackers deleted the workflow run logs.

How the wfx-loot attack works

The attackers first open a pull request titled “docs: dependency audit notes” from a branch named wfx-docs. That probe confirms the stolen token has write access to the repository. Where it does, a shell script of about 1,500 lines is injected into a GitHub Actions workflow and runs when the workflow executes.

The script collects GitHub Actions secrets, runtime tokens, cloud credential files, shell histories and tokens for AI tools including OpenAI, Anthropic and Hugging Face. It then tries to reach AWS, Google Cloud and Azure, and to create long-lived access keys so the attackers can return later.

Packages caught in the campaign

Automated publishing carried the payload into the Packagist package digitalelvis/neuronai-studio version 3.14.3 and the Go module github.com/onuragtas/docker-env versions 1.0.278 and 1.0.280. Aikido says any machine that installed or opened the Packagist package should be treated as compromised.

At least 50 of the compromised accounts also publish packages for npm, Go, Packagist, PyPI or crates. Aikido found overlap with the GhostAction campaign from October, but does not attribute the two waves to the same actor. There is no vendor fix to apply: affected teams should rotate exposed credentials, audit their repositories for the wfx-docs branch and the probe pull requests, and remove the affected package versions.