"wfx-loot" campaign abuses 4,800+ hijacked GitHub accounts to plant CI secret stealer; credentials exfiltrated from at least 1,835 repositories

Aikido says that since November 10 an attacker has used stolen GitHub credentials across 4,837 compromised accounts to open probe pull requests in 61,764 repositories, and at least 1,835 repositories ran the payload and had GitHub Actions secrets and cloud credentials stolen ^[1]. SecurityWeek reports StepSecurity said the attacker does not exploit a GitHub Actions bug but uses valid developer and bot tokens to plant the malware in workflows, CI scripts and npm install hooks, then reverts changes and deletes run logs to hide ^[2]. If a repository shows a wfx-docs branch, a "docs: dependency audit notes" pull request or related commits, treat the account as compromised, revoke its tokens, and rotate every secret and cloud role its workflows could reach ^[1][2].

Industries mainly affected: Technology

1. Check repositories you can write to for a wfx-docs branch, a "docs: dependency audit notes" PR, or commits titled "ci: refresh build cache", "chore: add ci helper" or "chore: add dependency audit workflow" .