wfx-loot GitHub CI Stealer Still Running, Researchers Say

Researchers say a campaign they call wfx-loot used stolen GitHub credentials to push a malicious workflow into tens of thousands of repositories, starting on 10 November 2026, and that the payload steals GitHub Actions secrets and cloud credentials. The Aikido Security account, written by Oliver Smith and dated 12 November, says the activity began at about 12:45 GMT on 10 November. There is no GitHub statement.

The practical risk is not a bug in GitHub Actions. It is what a valid token can already do. StepSecurity, which is tracking the same activity under the name WFX Phantom, says the attacker has valid tokens for real developer and bot accounts and uses them the way a developer would, by opening pull requests and pushing commits. Both firms published on 12 November. StepSecurity, writing as of 07:40 GMT that morning, said new probe pull requests were still appearing every few minutes.

wfx-loot counts are each vendor’s own

The two write-ups should be read as separate snapshots, not as one combined total. Aikido says 4,837 compromised accounts opened probe pull requests in 61,764 repositories, and that a GitHub search returned 61,839 pull requests titled “docs: dependency audit notes” between 12:45 GMT on 10 November and 15:00 GMT on 11 November. It says 10,431 of those pull requests went into repositories the account does not own, reached through collaborator or organisation access, and that 92% of them were still open.

StepSecurity, later on the morning of 12 November, said GitHub search returned more than 63,000 of the attacker’s probe pull requests, about 90% of them still open. Those are StepSecurity’s figures, taken later than Aikido’s window, and they should not be merged with Aikido’s counts.

On damage, Aikido says at least 1,835 repositories ran the payload and have had credentials exfiltrated. In the same post it also says it has identified indications that the payload ran in at least 1,806 repositories, and that this number may understate the impact because the run log was deleted in affected repositories. It also says at least 50 compromised users appear to publish packages for ecosystems including npm, Go, Packagist, PyPI or crates. Aikido has identified a Packagist package, digitalelvis/neuronai-studio version 3.14.3, and a Go module, github.com/onuragtas/docker-env versions v1.0.278 and v1.0.280, in which the payload sits in a GitHub Actions workflow file only. It says the Go source and release binaries are unchanged, and that Go builds never run workflow files, but still recommends removing those packages.

This is not the first time TSN has covered stolen GitHub tokens being used to reach CI secrets: Wiz described the Gheist campaign in those terms. Earlier researcher reports have also covered an npm worm that armed GitHub repositories and a malicious LiteLLM release on PyPI that stole credentials.

The probes are only the first step

Aikido and StepSecurity describe a recognisable first move: a pull request titled “docs: dependency audit notes”, opened from a wfx-docs branch. That request is a probe. The researchers say the payload arrives later, in commits titled “ci: refresh build cache”, “chore: add ci helper” or “chore: add dependency audit workflow”, sometimes on short-lived branches named chore/ followed by eight random characters. Aikido says the actor then reverts and deletes the workflow run, often within a minute, so a missing run number may be the only trace left in the history.

StepSecurity says that from about 05:30 GMT on 12 November, new copies of the payload sent stolen data only to Telegram, after Telegram had first appeared as a backup earlier that morning, and that “Blocking the published IP addresses no longer stops it.” It also says the attacker tries to persist in AWS and Azure after ordinary credential rotation, including by adding federated identity credentials named wfx-ci- and by leaving AWS sessions named wfx-. Aikido gives the same class of advice: if the payload ran, assume every secret and cloud role available to the repository’s workflows is compromised, rotate those secrets and roles, check CloudTrail for session names starting wfx-, and delete Azure federated credentials named wfx-ci-*.

“The attacker does not exploit a bug in GitHub Actions,” StepSecurity says.

A running campaign with two tape-measures and no official tally

The claim that matters today is that researchers still saw the campaign moving on the morning of 12 November, and that the usual first defence of blocking a published address is, on StepSecurity’s account, no longer enough. That is why the item is urgent: anyone who can write to a repository that accepted one of those probe pull requests has to treat the token, and whatever the workflows could reach, as suspect until it has been rotated and the cloud side has been checked.

The counts will keep sliding, and they already disagree, because they are not a joint investigation. Aikido’s 4,837 accounts and 61,764 repositories, its 1,835 exfiltrated-run figure and its lower 1,806 “indications” figure, are Aikido’s. StepSecurity’s more than 63,000 probe pull requests, about 90% still open as of 07:40 GMT on 12 November, are StepSecurity’s. Neither firm is GitHub, and no GitHub statement has been issued to settle the scale. Readers should take the warning seriously and the numbers as vendor snapshots.

The more durable point in both write-ups is the persistence trick. A stolen token is bad enough; a foothold that survives a routine secret rotation is worse, because a team can believe it has closed the incident while a workflow in the same repository can still mint a new cloud session. That is also why the researchers’ indicators — the probe title, the commit messages, the wfx- session names and the wfx-ci-* federated credentials — are more useful today than any single count. The next thing to watch is whether GitHub itself describes the campaign, and whether the probe pull requests finally stop appearing.

Sources

1. Oliver Smith, Aikido Security, “wfx-loot campaign pushes CI secret stealer to tens of thousands of repositories,” 12 November 2026. https://www.aikido.dev/blog/compromised-github-accounts-push-ci-secret-stealer-to-tens-of-thousands-of-repositories
2. StepSecurity, “WFX Phantom: The GitHub Actions Secret Stealer,” 12 November 2026. https://www.stepsecurity.io/blog/wfx-phantom-the-github-actions-secret-stealer

Related stories

Wiz Says Gheist Campaign Uses Stolen GitHub Tokens to Steal CI Secrets is the nearest TSN account of stolen GitHub tokens being used to take CI secrets.

Also relevant:

• JFrog Says npm Worm Campaign Armed 42 GitHub Repos From 11 Owners
• Malicious LiteLLM Release on PyPI Stole Credentials, Researchers Say