4,837 GitHub accounts hijacked to steal cloud and CI credentials

Attackers compromised 4,837 GitHub accounts and probed 61,764 repositories in a credential-stealing campaign that began at 12:45 UTC on November 10. Researchers at application security company Aikido, who named the operation 'wfx-loot', confirmed secrets were stolen from at least 1,835 repositories.

The threat actor used the stolen credentials to open pull requests titled 'docs: dependency audit notes' against every repository the compromised accounts could access. The goal was to test whether each account held sufficient write permissions to inject malicious code. Aikido reports that 92% of those pull requests remain open, suggesting legitimate repository owners never noticed the activity.

Who was affected?

Compromised accounts belonged to Fortune 100 organizations, the US General Services Administration, the French government, Nextcloud, and WebdriverIO. Aikido says about 50 of the accounts appear to hold publishing rights on other open-source ecosystems and package indexes, including npm, PyPI, Go, crates, and Packagist.

How did the attack work?

The attackers delivered a 1,500-line credential-stealing shell script through three vectors:

• Modifying an existing GitHub Actions workflow (CI/CD automation pipelines).
• Adding a new workflow on a short-lived branch.
• Planting an npm install hook.

The script harvested a broad set of secrets. It collected GitHub Actions variables, the workflow's GITHUB_TOKEN, OIDC (OpenID Connect) tokens, and Actions runtime tokens. It targeted cloud credentials for AWS, Azure, and Google Cloud, including those exposed through instance metadata on self-hosted runners.

It also swept developer and infrastructure credentials from Git, SSH, GPG, Docker, Kubernetes, npm, PyPI, Vault, and Terraform configurations. AI service credentials for OpenAI, Anthropic, Gemini, Hugging Face, Cursor, and GitHub Copilot were in scope.

Additional sources included environment variables, .env files, private keys, keystores, shell histories, process memory, repository files and recent commits, and workflow artifacts.

What about cloud escalation and persistence?

The script supported cloud privilege escalation. It exchanged GitHub OIDC tokens for temporary AWS, Azure, and GCP sessions. In AWS, it chained into additional IAM (identity and access management) roles present in the repository to create long-lived credentials for IAM users, according to Aikido. In GCP, it used collected service-account credentials to impersonate identities.

Aikido notes the tooling can establish persistent access by creating long-lived credentials or modifying cloud identity and trust policies where permissions allow. The script compressed stolen data into tarballs and exfiltrated it via HTTP POST to two attacker-controlled endpoints. In the final stage, the attacker reverted changes and deleted workflow runs and logs in under a minute.

Did the payload reach package registries?

Automated publishing carried the payload into three public releases:

• Packagist package digitalelvis/neuronai-studio, version 3.14.3.
• Go module github.com/onuragtas/docker-env, versions v1.0.278 and v1.0.280.

Aikido believes the primary objective was stealing CI (continuous integration) secrets, and the package releases were a byproduct of automated publishing pipelines. The researchers also found certain overlaps with the 2025 GhostAction campaign.

What should repository owners do now?

Aikido advises owners to look for three indicators: a 'wfx-docs' branch, the probe pull request, and gaps in workflow run numbers. Where payload execution is confirmed, all secrets and cloud roles available to the affected workflows should be treated as compromised and rotated immediately.