A secret-stealing campaign that researchers call wfx-loot has turned hijacked GitHub accounts into a delivery system for cloud and artificial intelligence credentials, running its payload in at least 1,806 repositories and probing tens of thousands more.
Aikido Security, which detected and documented the campaign, said attackers used 4,837 compromised accounts to open probe pull requests in 61,764 repositories starting on November 10. The probes, titled "docs: dependency audit notes," were benign on their own. They checked whether a hijacked account had write access, so the attackers could follow up with commits carrying the real payload. About 92 percent of those pull requests were still open when Aikido reported the campaign, suggesting most project owners had not yet seen them.
The payload is a shell script of about 1,500 lines that collects GitHub Actions secrets, cloud credentials, and API keys for AI services and developer tools. Aikido said it was delivered in at least three ways: by modifying existing GitHub Actions workflows, by adding a postinstall hook in a package.json file that runs on every npm install, and by creating a throwaway branch with a rogue workflow. That second route mattered. GitHub's safeguard requiring approval before unfamiliar workflows run held the workflow versions, according to GitGuardian, but the npm hook changed no workflow file, so a repository's own unchanged workflows ran it as routine build work.
Once the script runs, it receives repository and organization secrets through a dump of the workflow's secrets, scans the runner process memory, where secrets sit in decrypted form, and collects credential files, shell histories, and keys for services such as OpenAI, Anthropic, Copilot, and Cursor. It then exchanges OpenID Connect tokens for AWS, Google Cloud, and Azure sessions, mints new long-lived AWS keys, impersonates Google service accounts, and replays cached Azure refresh tokens to reach Microsoft Graph and Key Vault. Everything collected is sent to the attacker. In most repositories the malicious commit was reverted within about a minute and the workflow run and its logs were deleted.
That cleanup is why defenders should not treat the confirmed count as the full count. "We've identified indications that the payload ran in at least 1,806 repositories, but this number may understate impact," the Aikido researchers said, noting that the run log was deleted in affected repositories.
The script also plants persistence that can survive a password reset. On AWS it rewrites an assumed role's trust policy to accept any AWS account and creates long-lived keys. On Azure it injects federated identity credentials named wfx-ci-* into applications, pointing them back at the compromised repository, so a workflow there can authenticate to Azure without a stored secret even after tokens are rotated. The payload also shipped in published packages, including the Packagist package neuronai-studio version 3.14.3 and the Go modules docker-env and gocurl.
About a fifth of the accounts used here had already been compromised during the GhostAction attack in October, GitGuardian said. StepSecurity traced 173 probe pull requests to Fly.io GitHub App tokens, which Fly.io confirmed were leaked from configuration files in build directories that some apps served publicly. Fly.io itself was not breached.
For enterprise teams, the instruction from researchers is direct. If a probe pull request or one of the campaign's commit strings appears in a repository you control, assume every secret its workflows could reach is stolen. Rotate repository and organization secrets, package registry tokens, and cloud keys, then hunt for AWS role trust policies that accept any account, IAM keys created since November 10, and Azure federated credentials named wfx-ci-*.