An attacker used stolen credentials for 4,837 GitHub accounts to plant a CI secret stealer that ran in at least 1,806 repositories, according to Aikido Security, which named the campaign wfx-loot. New probe pull requests were still appearing early on November 12, so the campaign appeared ongoing.
Probe Pull Requests Opened in 61,764 Repositories
The campaign began Tuesday, November 10. Each attack started with a probe pull request titled “docs: dependency audit notes” from a branch named wfx-docs. Aikido counted such pull requests in 61,764 repositories. Of those, 10,431 were submitted through collaborator or organization access, and 92 percent remained open.
SafeDep’s Count of Malicious Commits
SafeDep counted 8,093 repositories that received malicious commits between 12:46 UTC on Tuesday and 04:36 UTC on Thursday. In 7,309 of them the stealer was added to an existing workflow. In 771 it arrived through an npm postinstall hook, which also runs on developer machines. SafeDep’s search covered only the default branches of public repositories.
More matching pull requests appeared between 05:04 and 05:38 UTC on November 12. How the attacker obtained the account credentials has not been explained.
What the 1,500-Line Script Steals and Changes
The script runs about 1,500 lines. It steals GitHub Actions secrets, cloud and SSH credential files, shell histories and AI tool tokens for OpenAI, Anthropic, Cursor and Copilot. It sends the data out through HTTP POST or Telegram.
Persistence Through AWS and Azure Changes
The stealer creates long-lived AWS keys and rewrites an AWS role trust policy so that it accepts any account. It also adds Azure federated credentials that survive token rotation. The script forges passing status checks and reverts its changes within minutes. It then deletes run logs, which makes detection harder.
Packagist and Go Module Exposure
The payload also reached a Packagist package, digitalelvis/neuronai-studio 3.14.3, and a Go module, github.com/onuragtas/docker-env, in versions v1.0.278 and v1.0.280. Those packages extend the campaign beyond GitHub repositories into the dependency ecosystems that other projects pull from.
Researchers Describe How to Tell Whether the Stealer Ran
Researchers say a missing workflow run number is the most reliable sign the stealer ran, because the script deletes the logs of its own runs. Gaps in the numbering therefore point to runs that were erased.
Aikido and SafeDep advise treating every secret and cloud role reachable by workflows in affected repositories as compromised. Their guidance includes revoking tokens, OAuth grants, SSH keys and sessions, enabling two-factor authentication and rotating all repository secrets.
The two vendors’ numbers differ because they measure different things. Aikido counted the accounts used and the repositories where the stealer ran, while SafeDep counted repositories that received malicious commits within a fixed time window on default branches of public repositories only. Neither count captures private repositories, and the figures are likely to change as the probe pull requests continue.
The campaign’s mix of AI tool tokens with traditional cloud credentials in the target list shows how developer workstations and CI systems now hold a wider range of secrets than they did a few years ago.
Timeline and Ongoing Activity Seen by Aikido and SafeDep
The first malicious commits in SafeDep’s count landed at 12:46 UTC on November 10, and its last counted commits arrived at 04:36 UTC on November 12. Probe pull requests continued to appear after that window, between 05:04 and 05:38 UTC on November 12. The Hacker News and Help Net Security both reported the campaign, and both cite Aikido Security and SafeDep as the sources of the counts.
Researchers say every secret and cloud role reachable by workflows in affected repositories should be treated as compromised. That includes the long-lived AWS keys the script creates and the Azure federated credentials that survive token rotation, which means rotating tokens alone does not remove the attacker’s access.
The campaign’s footprint is large by any of the measures reported. Stolen credentials for 4,837 accounts fed probe pull requests in 61,764 repositories, and the stealer reached at least 1,806 repositories in Aikido’s count and 8,093 in SafeDep’s count of malicious commits.
