Thousands of GitHub accounts have been hijacked to plant a credential-stealing payload across the platform's code repositories, in one of the largest attacks on software supply chains in recent months. Security firm Aikido, which spotted the campaign and named it wfx-loot, says the operation began on November 10 and is still active, with new malicious pull requests appearing every few minutes.
The attacker used stolen credentials for 4,837 GitHub accounts to open probe pull requests in 61,764 repositories. In at least 1,835 of those repositories, the payload actually ran and sent credentials back to the attacker, according to Aikido. A separate analysis by SafeDep counted 8,093 repositories that received malicious commits between Tuesday and Thursday morning.
How the attack worked
Each intrusion started quietly. The attacker opened a pull request titled "docs: dependency audit notes" from a branch named wfx-docs, a probe to test whether the stolen account had write access to the repository. GitHub search results show 61,839 of these probe pull requests opened between November 10 and November 11, and more were still appearing on Thursday.
Where the probe succeeded, the attacker followed up with the real payload: a heavily commented shell script of about 1,500 lines that calls itself "wfx". It is designed to harvest everything a repository's continuous integration workflows can reach, including GitHub Actions secrets, cloud credentials for AWS, Azure and Google Cloud, SSH keys, and tokens for AI tools such as OpenAI, Anthropic, Cursor and Copilot. The script then exfiltrates the haul, initially by HTTP upload and, from November 12, through Telegram. To stay hidden, the attacker reverts each change within about a minute and deletes the workflow run that executed it.
The reach of a single stolen token is what makes the campaign so effective. More than 10,000 of the probe pull requests went into repositories the compromised account did not own, reached through collaborator or organisation access. And 92 percent of the probe pull requests are still open, meaning repository owners may not yet realise they were targeted.
The damage so far
The stolen credentials are the main prize, but the payload has also leaked into the software supply chain. Automated publishing triggers carried it into version 3.14.3 of the Packagist package digitalelvis/neuronai-studio, published on November 11 and fixed in version 3.14.4 the following day, and into Go modules including github.com/onuragtas/docker-env. Aikido advises treating any machine that installed or opened the affected Packagist package as compromised.
At least 50 of the hijacked users publish packages for npm, Go, Packagist, PyPI or crates, which widens the risk for anyone who depends on their work. Aikido assesses, however, that the attacker is focused on harvesting CI secrets rather than spreading through the supply chain, and the payload's spread into packages appears to be a side effect of automated publishing rather than the goal.
A familiar pattern, a different actor
The campaign overlaps with October's GhostAction wave, in which stolen GitHub accounts pushed secret-stealing workflows into repositories. Accounts hit by GhostAction were significantly more likely to be hit by wfx-loot, and in more than 100 repositories the new payload was injected into GhostAction's own workflow files. Aikido says the tools, servers and methods differ, and it does not attribute the November campaign to the same actor at this stage.
GitHub had not publicly commented on the campaign as of publication. Repository owners are advised to look for a wfx-docs branch, the probe pull request, or commits titled "ci: refresh build cache", "chore: add ci helper" or "chore: add dependency audit workflow", and to rotate any secrets that may have been exposed to affected workflows.
