CI Secret Stealer Hit 1,835 GitHub Repos in a Day

At least 1,835 GitHub repositories executed credential-stealing code pushed through CI pipelines this week, after 4,837 hijacked accounts opened probe pull requests across 61,764 repositories in roughly 24 hours. Aikido Security disclosed the campaign on Thursday, Nov. 12, and named it wfx-loot after the branch and identifier prefixes the attacker used.

The operation began around 12:45 UTC on Nov. 10. Over about a day, the attacker tested whether stolen access actually allowed changes. Where it did, the campaign planted its payload in GitHub Actions workflows, CI shell scripts or npm postinstall hooks — then reverted the change within a minute and deleted the workflow run and its logs, Aikido said.

Because the logs are gone, the true victim count may be higher. SafeDep separately counted 8,093 public repositories that received malicious commits, though receiving a commit does not mean the code ran.

Was GitHub Actions broken?

No. StepSecurity said the attacker exploited no bug in GitHub Actions and instead used valid tokens belonging to developers and bots. On 173 probe pull requests from 19 accounts, GitHub's API records the requests as made through the Fly.io GitHub App, which receives tokens to act as a user when that user connects GitHub to Fly.io.

StepSecurity has not established how those tokens were obtained. The firm said it has "no evidence of a breach of Fly.io's own infrastructure," and most of the campaign relied on other credentials such as personal access tokens. Neither GitHub, owned by Microsoft, nor Fly.io had commented in the researchers' reports.

What did the stealer take?

Plenty. The script hunts for a broad sweep of secrets:

• GitHub Actions secrets, GITHUB_TOKEN and OIDC tokens
• Cloud, Docker, Kubernetes, Vault and Terraform credentials
• npm and PyPI tokens
• AI provider keys
• Secrets lingering in runner process memory

It also escalates inside cloud environments. Aikido found the payload can create AWS access keys, rewrite AWS role trust policies to allow any principal, and add Azure federated identity credentials named "wfx-ci-". To slip past branch protection, it posts forged "success" status checks.

Stolen data left by HTTP POST to two IP addresses on port 8080. Tainted releases Aikido identified include Packagist package digitalelvis/neuronai-studio 3.14.3 and Go module github.com/onuragtas/docker-env in versions v1.0.278 and v1.0.280.

What should teams rotate?

Everything the workflows could reach. "If the payload ran in your repository, assume every secret and cloud role available to its workflows is compromised," Aikido said.

Aikido advises searching any repository you can write to for:

• wfx-docs branches
• Pull requests titled "docs: dependency audit notes"
• Commit messages such as "ci: refresh build cache"
• chore/ branches with eight random characters

StepSecurity takes a harder line on accounts: any account that opened a probe pull request should be treated as compromised. Revoke its personal access tokens, OAuth grants and SSH keys, and sign out its sessions.

Is this connected to earlier campaigns?

Some accounts overlap with October's GhostAction campaign, Aikido said, but the firm assessed wfx-loot as a separate actor. Leaked CI secrets have been a running problem this autumn across the software supply chain.

For engineering teams, the practical lesson is that build-pipeline credentials are live attack surface even when the platform itself has no flaw to patch — and with logs deleted, the safest assumption is that anything a workflow could touch is already in the attacker's hands.