Compromised GitHub Accounts Spread CI Secret-Stealing Malware Across 61,764 Repositories
Hari 
A threat actor began using stolen GitHub tokens on November 10, 2026 to push a credential-harvesting payload into repositories at scale. Aikido Security tracks the campaign as wfx-loot. Its data shows 4,837 compromised accounts opened probe pull requests in 61,764 repositories, and at least 1,835 repositories executed the payload and leaked credentials.
Each intrusion follows a fixed sequence. The operator opens a pull request titled “docs: dependency audit notes” from a wfx-docs branch to confirm write access. It then pushes one of three payload variants. The first is a roughly 1,500-line workflow injection committed as “ci: refresh build cache”.
The second is a .ci-xxxxxx.sh script paired with a package.json postinstall hook. The third is a throwaway workflow on a chore/ branch. The commit is reverted within a minute and the workflow run is deleted with its logs, so a missing run number is often the only trace.
Compromised GitHub Accounts Spread CI Secret-Stealing Malware
The injected step serializes toJSON(secrets) and toJSON(vars) into environment variables and posts them to 194.150.166[.]244:8080 or 18.143.168[.]96:8080 at /exfil.
The shell script self-identifies as wfx and works in four stages: collect, escalate, persist and exfiltrate. It harvests Actions secrets, the GITHUB_TOKEN, OIDC and runtime tokens, and credential files for AWS, Azure, GCP, Kubernetes, Vault and Terraform.
It also reads Runner.Worker and Runner.Listener process memory to recover JWTs and PATs. The focus on Anthropic, OpenAI, Gemini and Hugging Face keys resembles the AI-key triage in the VOLTA infostealer. The script also supports Telegram Bot exfiltration, a channel seen in the TraderTraitor fake Terraform provider campaign.
The deployed configuration disables the Telegram, Actions Cache, step summary and artifact channels and relies on HTTP POST alone.
Escalation and persistence are the most damaging features. The payload exchanges OIDC tokens for AWS, GCP and Azure sessions, calls iam:CreateAccessKey, impersonates service accounts through generateAccessToken and signJwt, and replays FOCI refresh tokens against first-party Microsoft client IDs.
It forges success commit statuses using the names of required checks, which clears branch protection because matching is by context name rather than posting app.
It rewrites AWS trust policies to “Principal”: {“AWS”: “*”} and adds wfx-ci- federated identity credentials to Azure AD applications. Those credentials let workflows authenticate to Azure after every secret has been rotated.
Many compromised accounts overlap with the October wave documented in GhostAction’s fake-font credential stealer campaign. In more than 100 repositories, wfx-loot was injected into GhostAction workflow files.
Aikido nonetheless assesses two distinct actors. The infrastructure and tooling differ, and the wfx script contains Indonesian-language comments from a hasty edit that added Telegram exfiltration.
The payload has reached at least one Packagist and one Go package through automated publishing triggers. Packagist digitalelvis/neuronai-studio 3.14.3 carries it. Go module github.com/onuragtas/docker-env v1.0.278 and v1.0.280 contain it only in a workflow file, so Go consumers are unlikely to have been exposed.
Defenders should hunt for wfx-docs branches, chore/ branches with eight random characters, and gaps in workflow run numbering. They should treat every secret and cloud role reachable by an affected workflow as compromised.
AWS trust policies, Azure federated credentials and required-check configurations need review. Block the two callback addresses and rotate all tokens.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
Kiran 
