The pull request looked harmless — a two-line docs file titled "docs: dependency audit notes." It was the knock on the door. Starting Tuesday, an attacker used stolen credentials for 4,837 GitHub accounts to open that probe in 61,764 repositories, testing which accounts could still write code. Where they could, the payload followed: a ~1,500-line shell script that Aikido Security, which spotted the campaign and named it wfx-loot, says ran in at least 1,806 repos and harvested the credentials those CI workflows could reach.
SafeDep counted 8,093 repositories that received malicious commits between Tuesday and early this morning — public repos on default branches only, so the true total is higher. The stealer grabs GitHub Actions secrets, the workflow's GITHUB_TOKEN and OIDC tokens, and credential files for AWS, Azure, GCP, Kubernetes, npm, PyPI, and SSH — plus keys for AI services like OpenAI, Anthropic, Cursor, and Copilot.
What should worry teams most is not the theft but the persistence. According to The Hacker News, the stealer can rewrite an AWS role's trust policy to open it to any AWS account, and add `wfx-ci-` federated credentials to Azure AD apps — so the attacker's workflows keep signing in after every token is rotated. Rotating keys without hunting for those backdoors is closing the front door while the burglar keeps a key under the mat.
The attacker also cleaned up, usually reverting the commit within minutes and deleting the run logs — so many affected repos may show no trace. Aikido's advice is blunt: any account that opened a probe pull request should be treated as compromised, even if the stealer never ran, and every secret the repo can read should be rotated.
There's a quieter lesson too. The accounts overlap heavily with October's GhostAction campaign, and accounts compromised then were about 1,000 times more likely to be reused this week. Aikido isn't attributing the two waves to the same actor — stolen credentials change hands — but a compromised GitHub token is not a one-time incident.
The campaign also leaked into packages: version 3.14.3 of the Packagist package digitalelvis/neuronai-studio is malicious, and two versions of a Go module carry the stealer in a workflow file. The check is simple: search your repos for a `wfx-docs` branch or a "dependency audit notes" pull request. If you find one, assume the secrets are gone — and then go looking for the backdoors.
— via The Hacker News