625/69 Friday, November 13, 2026
Security researchers from Aikido have disclosed a campaign named wfx-loot, in which threat actors used 4,837 compromised GitHub accounts to scan and target 61,764 code repositories in an attempt to steal secrets stored in GitHub Actions and credentials used to access cloud environments. Researchers confirmed that secrets had already been stolen from at least 1,835 repositories. The campaign poses a significant software supply chain security risk because some of the compromised accounts belonged to Fortune 100 companies, U.S. and French government organizations, and open-source projects such as Nextcloud and WebdriverIO. Approximately 50 of the compromised accounts also had permissions to publish packages to major software ecosystems, including npm, PyPI, Go, crates, and Packagist.
The campaign began on November 10, 2026, when the attackers created a Pull Request titled docs: dependency audit notes to test whether the compromised accounts had write permissions. When a writable repository was identified, the attackers injected malicious scripts through GitHub Actions workflows or npm installation steps to steal tokens, cloud credentials for AWS, Azure, and Google Cloud, developer infrastructure credentials for services such as Docker, Kubernetes, and Terraform, and API keys for AI services including OpenAI, Anthropic, Gemini, and GitHub Copilot. The attackers also abused OIDC tokens to escalate privileges and establish persistent identities in cloud environments before exfiltrating data and deleting workflow execution history in less than one minute. Malicious code was also introduced into the digitalelvis/neuronai-studio package version 3.14.3 on Packagist and the Go module github.com/onuragtas/docker-env versions v1.0.278 and v1.0.280. The campaign shares similarities with the previously observed GhostAction activity, highlighting the importance of restricting token permissions and securely configuring OIDC trust relationships.
Administrators and developers should immediately review their GitHub repositories for indicators associated with the campaign, including a branch named wfx-docs, Pull Requests titled docs: dependency audit notes, and gaps in workflow run numbering that could indicate deleted execution history. Organizations should also avoid affected package versions. If a malicious workflow is confirmed to have executed, all exposed secrets, API keys, and related cloud access credentials should be revoked and rotated immediately. Administrators should also review IAM configurations and cloud identities for unauthorized changes or persistence mechanisms that could allow attackers to retain long-term access.