A supply chain campaign that turned routine-looking "docs" pull requests into a fleet-wide credential heist is still unfolding. Security firm Aikido Security, which has tracked the operation under the name wfx-loot, reports that attackers used 4,837 compromised GitHub accounts starting November 10 to open probe pull requests across 61,764 repositories — testing which stolen identities had write access where. The probes themselves carried no malware; they were access tests.
Where access allowed, attackers followed with malicious commits disguised as maintenance. Aikido has confirmed the payload executed in at least 1,835 repositories, exfiltrating CI/CD secrets and cloud credentials. Separate counts from OX Security and SafeDep measure a wider blast radius: more than 66,200 probe pull requests and malicious commits pushed into 8,093 public repositories in roughly the first two days, with more than 4,100 of the probes opened on November 12 alone. The three numbers measure different stages of the same funnel and should not be read as interchangeable.
The payload, a shell script of roughly 1,500 lines, reached workflows through several delivery paths Aikido documented — edits to existing GitHub Actions workflows, npm installation hooks, and new workflows on temporary branches — with StepSecurity later documenting a fourth that inserts the stealer into existing shell scripts the workflows already run, leaving the workflow file untouched. Once executed, it sweeps GitHub secrets, workflow tokens, cloud credentials, SSH and GPG keys, environment files, Kubernetes configurations and developer-tool credentials. The target list reads like a 2026 developer's keychain: AWS, Azure and Google Cloud keys alongside tokens for OpenAI, Anthropic, Google Gemini, Cursor, GitHub Copilot and Codex.
Coverage is where the operation shows real craft. After execution, attackers revert their changes and delete workflow run records and logs, sometimes within a minute — leaving owners with little more than a missing run number in the Actions history. From about 05:30 UTC on November 12, StepSecurity observed newer samples dropping the original collection servers entirely and exfiltrating only via Telegram, so blocking the initially published IP addresses does not stop the later variants.
The script also tries to convert repository access into durable cloud access. Using stolen credentials and GitHub's OpenID Connect authentication, it can request cloud sessions, create long-lived AWS access keys, rewrite AWS role trust policies, and add federated identity credentials to Azure applications — persistence mechanisms that survive token rotation. Targets extend to Google Cloud service accounts, Kubernetes clusters and HashiCorp Vault. The campaign also reached published packages: Aikido found malicious content in the Packagist package digitalelvis/neuronai-studio version 3.14.3 and in workflow files of versions of the Go module github.com/onuragtas/docker-env, though in the Go case the source code and release binaries were unchanged.
A parallel disclosure explains where some of the credentials came from. In a November 12 notice, Fly.io confirmed that an unauthorized party used tokens issued to its GitHub App against customer repositories, after its deployment process left a GitHub access token in the build directory's .git/config file that some applications then served publicly. Fly.io said misuse affected a small number of accounts, that it revoked every token issued to the App, and that its own systems were not breached.
Aikido's remediation guidance is deliberately blunt: any repository where the payload ran must treat everything it could reach as already in the attacker's hands. That means revoking tokens and OAuth authorizations, rotating all workflow secrets, and auditing cloud-side for backdoors — new AWS keys, altered trust policies, added Azure federated identities — because deleting the malicious code or even rotating an exposed secret does not remove an access key the attacker already created. Researchers advise checking for suspicious branches such as wfx-docs, pull requests titled "docs: dependency audit notes", and run numbers missing from Actions history on or after November 10.
Comments (0)
Log in to join the discussion
Log InNo comments yet