Stolen GitHub tokens planted a secret stealer in thousands of repos. Search yours for the probe pull request

Since Tuesday, someone holding stolen GitHub tokens has been opening a harmless-looking pull request in every repository those tokens can write to, then pushing a script that steals GitHub Actions secrets and cloud credentials. Aikido counts 4,837 compromised accounts, 61,764 probed repositories and at least 1,835 where the stealer ran.

The attacker reverts the change and deletes the workflow run within about a minute, so a clean-looking branch proves nothing.

A pull request titled “docs: dependency audit notes” is the first sign. If one showed up in your GitHub repos this week, assume your CI secrets are gone.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

Stolen GitHub tokens planted a secret stealer in thousands of repos

The campaign, which Aikido calls wfx-loot, started around 12:45 UTC on November 10. First comes a probe: a pull request titled “docs: dependency audit notes” from a branch named wfx-docs, which only confirms the token can write. Then the payload arrives in one of several ways.

• Workflow edit: a commit titled “ci: refresh build cache” adds about 1,500 lines to an existing workflow. StepSecurity also found the script pasted into shell scripts that CI already runs.
• npm hook: “chore: add ci helper” adds a hidden .ci-*.sh file and a postinstall hook, which also runs on any developer machine that installs dependencies.
• Throwaway branch: “chore: add dependency audit workflow” adds a new workflow on a chore/ branch.

The stealer collects every repository secret, the runner’s memory, cloud CLI files, SSH keys and AI service tokens. It also tries to leave AWS and Azure backdoors that survive rotation.

Any repository a compromised account or bot can write to

This is not a GitHub bug. The attacker uses valid tokens, including bot accounts with permission to bypass branch protection, so ordinary review doesn’t stop it. StepSecurity says about 90% of the probe pull requests were still open on Thursday, which suggests most owners haven’t noticed.

Blocking the published collection addresses isn’t enough either. Since early Thursday UTC, new copies send stolen data to a Telegram chat instead.

Search for the probe pull request, then rotate what CI could read

• Search your organization’s pull requests for “docs: dependency audit notes” and branches named wfx-docs, and commits since November 10 titled “ci: refresh build cache”, “ci: restore”, “chore: add ci helper” or “chore: add dependency audit workflow”.
• For each hit, check the Actions tab for a missing run number right after the commit. A gap means the stealer probably ran.
• If it ran, rotate every secret, publishing token and cloud credential that workflow could reach, not just the ones it names.
• Revoke the tokens, OAuth grants and SSH keys of the account that pushed the commit, including bot accounts.
• In AWS, look for role trust policies with "Principal": {"AWS": "*"} and new access keys. In Azure, delete federated identity credentials named wfx-ci-*.

Details

• Scale (Aikido, November 12): 4,837 compromised accounts; 61,764 repositories probed; at least 1,835 ran the payload; at least 50 compromised users publish packages.
• Packages carrying the payload: Packagist digitalelvis/neuronai-studio 3.14.3; Go github.com/onuragtas/docker-env v1.0.278 and v1.0.280 (workflow file only).
• Collection servers: 194.150.166.244, 18.143.168.96 and 153.75.82.159 on port 8080; Telegram since about 05:30 UTC November 12 (StepSecurity).
• No CVE: the campaign uses stolen credentials, not a vulnerability. Some tokens were issued to the Fly.io GitHub App, StepSecurity says, with no evidence of a breach at Fly.io.

Hunt / verify

• Check composer.lock and go.sum for the package versions above.
• In CloudTrail, look for sessions named wfx-* followed by CreateAccessKey or UpdateAssumeRolePolicy.
• Check whether any commit was merged on the strength of a status check that nobody’s CI actually ran.

Source: Aikido report; StepSecurity analysis

Sources

• Aikido: wfx-loot campaign pushes CI secret stealer to tens of thousands of repositories
• StepSecurity: WFX Phantom, the GitHub Actions secret stealer that deletes its tracks
• BleepingComputer: Hackers compromise 4,800 GitHub accounts to steal cloud credentials
• SecurityWeek: Attacker Targets 60,000 GitHub Repositories in Credential Theft Campaign

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].