wfx GitHub Actions Secret Stealer Targets 1,806+ Repos

Software engineering teams, cloud infrastructure groups, and security operations centers (SOCs) are dealing with one of the largest automated CI/CD supply-chain and cloud-identity compromises recorded in 2026. Between November 10 and 13, 2026, an attacker weaponized stolen credentials for 4,837 hijacked developer accounts on GitHub to probe more than 61,764 repositories.

The same operator then ran the wfx GitHub Actions secret stealer in at least 1,806 to 1,835 of them, according to research from Aikido Security and SafeDep reported by The Hacker News, BleepingComputer, and SecurityWeek.

The danger goes well beyond stolen repository variables. Unlike conventional CI/CD credential harvesters, this payload exchanges OpenID Connect (OIDC, an identity protocol that lets GitHub Actions workflows log into cloud providers without static passwords) tokens to reach Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP).

It then plants cloud identity backdoors built to survive credential rotation, as detailed by Chainguard and Phoenix Security.

Defenders should audit GitHub audit logs, Entra ID federated credentials, and AWS IAM role trust policies right away.

Quick Answer

The wfx GitHub Actions secret stealer (wfx-loot) is an active supply-chain campaign. Starting November 10, 2026, it used 4,837 compromised GitHub accounts to open wfx-docs test pull requests across 61,764+ repositories, inject malicious CI workflows into 8,093 repositories, and steal secrets from 1,806+ repositories. Along the way, it backdoored AWS IAM roles and Azure Entra ID apps (wfx-ci-*) through OIDC tokens.

What Happened and Incident Timeline

The campaign began around 12:45 UTC on Tuesday, November 10, 2026, and kept running through November 12 and 13. Per Chainguard and Barrier Networks, an automated pipeline fed stolen GitHub tokens and bot credentials into an engine built to probe repositories and harvest secrets.

Confirmed Facts

• Probing 61,764+ Repositories via wfx-docs Branches: Aikido Security and SafeDep, as reported in The Hacker News and Chainguard, found that the attacker used 4,837 compromised GitHub accounts to open a wfx-docs pull request probe across 61,764 repositories. The pull request was titled docs: dependency audit notes and came from a branch named wfx-docs. Barrier Networks puts the total at 63,000+ pull requests. Notably, 10,431 of the test pull requests landed in external organizations through collaborator or org access, and 92% were still open when checked.
• Malicious Commits in 8,093 Repos and Execution in 1,806+ Repos: SafeDep counted 8,093 public repositories that received malicious commits between 12:46 UTC on November 10 and 04:36 UTC on November 12. Aikido confirmed stealer execution in 1,806 to 1,835 public repositories, per Phoenix Security.
• 1,000x Overlap With October’s GhostAction Victims: Accounts hit in October’s GhostAction wave were roughly 1,000 times more likely to be reused in November. In 100+ repositories, the wfx payload was appended onto October’s GhostAction workflow files, per The Hacker News.
• Downstream Bot and Package Impact (wdio-bot and neuronai-studio): The stealer touched 28 WebdriverIO repositories through the hijacked bot wdio-bot, although no WebdriverIO release was affected. It also reached Packagist package digitalelvis/neuronai-studio version 3.14 through automated publishing, per Chainguard. At least 50 compromised accounts maintain packages on npm, PyPI, Go, Packagist, and crates.io.

Reported or Unconfirmed Claims

• Attribution Gap: Aikido told The Hacker News that it does not attribute wfx to the GhostAction actor, because the tools and infrastructure differ and stolen credentials are often resold.
• Private Repository Count: Researchers scanned only public repositories, although wfx includes settings for private repositories.

The table below outlines the confirmed chronological sequence of the wfx campaign.

Facts at a Glance

The table below summarizes the verified technical attributes of the wfx (wfx-loot) campaign.

Affected and Fixed Versions

The table below maps affected repositories and packages verified by Chainguard and The Hacker News.

Technical Attack Chain

1. How the CI Secret Stealer Probes, Harvests, and Backdoors Cloud Accounts

Per Aikido Security, SafeDep, Chainguard, and Phoenix Security, the wfx GitHub Actions secret stealer operates in four stages:

1. Write-Access Probing (MITRE ATT&CK T1078.004, Cloud Accounts): Using credentials from 4,837 hijacked developer accounts, automation opens a wfx-docs pull request probe (docs: dependency audit notes from wfx-docs) across every repository those accounts can reach. That includes 10,431 cross-organization pull requests.
2. Ephemeral Workflow Injection (T1195.002, Compromise Software Supply Chain): Where a repository is writable, the pipeline injects the stealer into .github/workflows/*.yml or npm postinstall hooks. It typically reverts the commit within minutes of execution, so the branch looks clean.
3. Runner & AI Token Harvesting (T1552.001): Inside the runner, wfx scrapes Actions secrets, GITHUB_TOKEN, SSH/GPG keys, runner memory, and self-hosted metadata, Docker, and systemd state. It also grabs OpenAI, Anthropic, Cursor, and Copilot tokens, then posts the loot to three servers and Telegram.
4. Cloud Persistence via OIDC (T1098.001 / T1098.003): The payload exchanges GitHub OIDC tokens for live AWS, Azure, GCP, and Vault sessions.
   • AWS IAM Persistence: The payload establishes AWS AssumeRole trust policy persistence through AssumeRoleWithWebIdentity / AssumeRole sessions named wfx-*. It then calls CreateAccessKey for IAM users and UpdateAssumeRolePolicy to open the role’s trust policy to any AWS account.
   • Azure Entra ID Persistence: It plants a wfx-ci federated identity backdoor by adding wfx-ci-* federated credentials to Azure AD app registrations, which lets workflows sign into Azure without a stored secret.

Why Rotating Repository Secrets Alone Will Not Evict the Attacker

• Federated Credentials Bypass Rotation: Per Phoenix Security, a wfx-ci federated identity backdoor uses OIDC tokens rather than secrets, so it survives rotation until wfx-ci-* is deleted.
• Modified AWS Roles Allow External Access: Roles altered by UpdateAssumeRolePolicy remain assumable externally after key rotation.
• Reverted Commits Hide Evidence: Because wfx reverts its commit within minutes, teams must inspect git log --all --full-history and cloud logs.

CyberInfos Analyst Insight

• CyberInfos Assesses That the 1,000x GhostAction Overlap Proves Unrotated Developer Tokens Are a Chronic Liability: Reusing October GhostAction victims across November’s 4,837 hijacked developer accounts shows that cleaning malicious YAML without revoking the underlying developer tokens all but guarantees re-compromise.
• From a Defensive Perspective, OIDC Trust Mutation Turns Passwordless CI/CD Into a Backdoor: A two-minute OIDC session is enough to call UpdateAssumeRolePolicy in AWS and add wfx-ci-* federation in Entra ID. That turns identity federation against the people defending the cloud.
• Collaborator Sprawl Multiplies Supply-Chain Risk: Opening 10,431 pull requests through external collaborator access shows how one compromised contributor token can expose dozens of partner organizations.

Indicators of Compromise and Hunting Telemetry

Defenders across GitHub, AWS, Azure, GCP, and Vault should hunt for the verified indicators published by Aikido, SafeDep, The Hacker News, and Chainguard. The table below lists all verified indicators, including AWS AssumeRole trust policy persistence and Entra ID federation artifacts.

Use the following SIEM queries (labeled Draft for testing, not production-validated) to hunt AWS CloudTrail and Entra ID logs:

/* Splunk SPL (Draft for testing, not production-validated):
   Hunt AWS CloudTrail for wfx-* OIDC AssumeRole sessions and follow-on IAM persistence (CreateAccessKey / UpdateAssumeRolePolicy) */
index=aws sourcetype="aws:cloudtrail"
(eventName IN ("AssumeRoleWithWebIdentity", "AssumeRole", "CreateAccessKey", "UpdateAssumeRolePolicy"))
(requestParameters.roleSessionName="wfx-*" OR userIdentity.arn="*wfx-*" OR eventName IN ("CreateAccessKey", "UpdateAssumeRolePolicy"))
| stats count earliest(_time) as first_seen latest(_time) as last_seen values(eventName) as events values(requestParameters.roleName) as roles values(requestParameters.userName) as target_users by sourceIPAddress, userIdentity.arn, awsRegion
| sort - count

// Microsoft Sentinel / Defender KQL (Draft for testing, not production-validated):
// Hunt Microsoft Entra ID AuditLogs for rogue wfx-ci-* federated identity credentials added to App Registrations
AuditLogs
| where TimeGenerated >= datetime(2026-11-10T00:00:00Z)
| where Category == "ApplicationManagement"
| where OperationName has_any ("Update application", "Add federated identity credential", "Add service principal credentials")
| where tostring(TargetResources) has "wfx-ci-"
| project TimeGenerated, OperationName, InitiatedBy, TargetResources, Result, CorrelationId
| order by TimeGenerated desc

Recommended Actions

Work through these numbered steps in three phases, per SafeDep, Aikido, and Chainguard.

Immediate Actions (0 to 24 Hours)

1. Audit Repos for wfx-docs and Reverted Commits: Search repos and reflogs for wfx-docs branches, docs: dependency audit notes PRs, or commits reverted since Nov 10. Treat any account that opened a wfx-docs PR as compromised.
2. Evict wfx-ci-* Entra and wfx-* AWS Backdoors: Delete any wfx-ci federated identity backdoor (wfx-ci-*) in Entra ID. Check AWS CloudTrail for wfx-* sessions plus CreateAccessKey or UpdateAssumeRolePolicy, and audit GCP and Vault logs.
3. Revoke Tokens and Rotate Secrets: Revoke personal access tokens, OAuth grants, and SSH keys for hit accounts, enforce 2FA, and rotate all CI, cloud, registry, and AI keys (OpenAI, Anthropic, Cursor, Copilot).

Short-Term Actions (Within 7 Days)

4. Rebuild Self-Hosted Runners and Exposed Workstations: Decommission and rebuild any self-hosted runner or machine that executed an affected commit or installed digitalelvis/neuronai-studio 3.14.
5. Prune External Collaborator Write Access: Remove stale outside-collaborator write permissions across organization repositories.

Long-Term Actions (Architecture)

6. Enforce Protected OIDC Subject Claims and Real-Time Trust Alerts: Restrict cloud OIDC trust policies to protected refs/heads/main environments, and alert on any UpdateAssumeRolePolicy call or Entra federated-credential addition.

Global Regulatory and Compliance Implications (USA, UK, Australia, EU, Canada, India)

Regulatory duties apply only when an organization is in scope and suffers a reportable incident. The table below summarizes verified compliance rules across six jurisdictions as of November 13, 2026.

This summary supports operational readiness and is not legal advice.

Frequently Asked Questions (FAQ)

What is the wfx GitHub Actions secret stealer and how many accounts were compromised?

The wfx GitHub Actions secret stealer (wfx-loot) is an automated supply-chain campaign that Aikido Security and SafeDep disclosed on November 12, 2026. Starting November 10, an attacker used stolen credentials for 4,837 GitHub accounts to probe 61,764+ repositories, push malicious commits to 8,093 repositories, and harvest CI/CD and cloud secrets from at least 1,806 to 1,835 repositories, per The Hacker News.

How are the hijacked developer accounts connected to October’s GhostAction wave?

Aikido Security’s analysis, reported by The Hacker News and Barrier Networks, shows that the 4,837 hijacked developer accounts overlap heavily with victims of October’s GhostAction campaign. Those victims were roughly 1,000 times more likely to be reused this week. Researchers have not, however, attributed both waves to the same threat actor.

How can repository owners detect if they were targeted by the wfx campaign?

Chainguard advises defenders to search all repositories and Git reflogs for a wfx-docs pull request probe titled docs: dependency audit notes from a branch named wfx-docs. They should also inspect deleted or reverted workflow commits between November 10 and November 13, 2026.

Why does rotating GitHub secrets fail to remove the Azure Entra ID backdoor?

During execution, the stealer exchanges GitHub OIDC tokens to plant a wfx-ci federated identity backdoor (wfx-ci-*) on Azure AD application registrations, per Phoenix Security. Federated identity credentials authenticate workflows with OIDC tokens rather than stored secrets, so attackers keep Azure access until the rogue wfx-ci-* federation entry is deleted.

How does the wfx payload maintain access inside Amazon Web Services environments?

In AWS environments, the malware establishes AWS AssumeRole trust policy persistence by exchanging a GitHub OIDC token for an AssumeRoleWithWebIdentity session named wfx-*. It then calls CreateAccessKey to mint permanent IAM user keys and UpdateAssumeRolePolicy to open the IAM role’s trust policy to external AWS accounts, per The Hacker News.

Final Thoughts

The rapid spread of the wfx GitHub Actions secret stealer is a wake-up call for every engineering team that relies on CI/CD automation and cloud OIDC federation. The payload reverts its commits within minutes and rewrites AWS IAM trust policies and Azure Entra ID federated credentials (wfx-ci-*). Merely rotating repository variables leaves your cloud accounts exposed.

Audit GitHub logs for wfx-docs branches and reverted runs immediately. Remove unauthorized wfx-ci-* Entra ID credentials and modified AWS role trust policies, and revoke unrotated GhostAction tokens. Share your findings in the comments below, and subscribe to CyberInfos.in for daily verified threat intelligence.