An attacker used 4,837 hijacked GitHub accounts to probe 61,764 repositories and deploy a credential-stealing payload that ran in at least 1,835 of them, according to Aikido Security. The campaign, dubbed wfx-loot, began Nov. 10 and targeted repositories accessible to the compromised developer and bot accounts.
The 61,764 repositories represent test pull requests designed to determine whether the stolen accounts had write access; they do not mean the malware executed everywhere. Separately, SafeDep counted 8,093 public repositories that received malicious commits. The payload ran where repository permissions and workflow configurations allowed it, and attackers often reverted changes and deleted workflow runs to reduce evidence, according to SecurityWeek’s report.
The roughly 1,500-line shell script was inserted into existing or newly created GitHub Actions workflows, CI shell scripts and npm installation hooks. It searched for GitHub Actions secrets and tokens, cloud credentials, package-registry keys, SSH and developer credentials, and API keys for services including OpenAI, Anthropic, Cursor and GitHub Copilot. It also attempted to read runner process memory and support follow-on access in AWS and Azure.
Researchers said the operation did not exploit a GitHub Actions vulnerability. Instead, it abused valid permissions attached to stolen personal, bot and application tokens. StepSecurity traced 173 probe pull requests to tokens issued to the Fly.io GitHub application, but reported no evidence that Fly.io’s infrastructure had been breached and did not establish how those tokens were obtained. No CVE, vendor patch or public exploit is associated with the campaign; the primary risk is account and token compromise.
Organizations whose repositories received a probe pull request or malicious change should treat the associated account and any secrets available to a successful workflow as compromised. Defenders should revoke personal access tokens, OAuth grants and SSH keys tied to affected accounts, rotate repository, cloud and package-registry secrets, review GitHub audit and Actions logs, and investigate AWS, Azure and other cloud activity for unauthorized changes. Teams should also inspect recent workflow, script and package.json modifications, while recognizing that deleted runs and reverted commits may leave an incomplete trail.
