A campaign using hijacked GitHub credentials has pushed a CI secret stealer called wfx into thousands of repositories since November 10. Endor Labs’ latest update says malicious changes reached 8,926 repositories, with at least 1,806 showing confirmed credential theft. Aikido separately reported that 1,835 repositories ran the payload and had credentials exfiltrated, while counting 4,837 compromised accounts probing 61,764 repositories. The researchers’ counts differ slightly, but both put confirmed theft above 1,800 repositories.
The attackers are using valid developer and bot tokens, not a vulnerability in GitHub Actions. The payload runs inside GitHub Actions, where it collects repository secrets, cloud credentials, package-registry tokens and AI-provider API keys. StepSecurity says the script also reads memory from GitHub Actions runner processes, exposing secrets that may not appear in workflow files.
The researchers found that the malware can use collected credentials to create persistent AWS access keys and Azure federated credentials, which may remain usable after exposed tokens are rotated. Attackers first open a seemingly harmless pull request titled docs: dependency audit notes from a wfx-docs branch to test whether a stolen token can write to a repository. If permissions allow, they push the payload through a modified workflow, a hidden shell script or an npm postinstall hook, as detailed in Aikido’s analysis and Endor Labs’ updated research.
After the workflow runs, the attackers quickly revert their changes and delete the GitHub Actions run and its logs, leaving gaps in the run-number sequence. StepSecurity observed the campaign switching to Telegram for data theft from about 05:30 UTC on November 12, with later samples carrying no collection IP address. BleepingComputer reported that some compromised accounts belonged to Fortune 100 organizations, the US General Services Administration and the French government.
Endor Labs identified activity in open-source projects including Nextcloud/docker and WebdriverIO, and said at least 50 hijacked accounts publish packages to npm, Go, Packagist, PyPI or crates. It also confirmed malicious versions in Packagist and Go. The campaign shares some indicators with earlier GhostAction activity and the Gheist credential-theft campaign, but researchers have not attributed the current operation to the same actor.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
