wfx-loot: 4,837 hijacked GitHub accounts stole CI secrets

Rotating your keys will not end this one. A campaign called wfx-loot used 4,837 hijacked GitHub accounts to push a CI secret stealer into tens of thousands of repositories since November 10. The stealer ran in at least 1,806 of them. It takes every secret your pipeline can reach, then plants access in Azure and AWS that survives a rotation. OX Security says the campaign is still live.

What actually happened

There is no GitHub Actions bug here. The attacker holds valid tokens for real developer and bot accounts.

• The probe. Each account opens a pull request titled docs: dependency audit notes from a wfx-docs branch to test write access. Aikido counted probes in 61,764 repositories. More than 10,000 of them belong to someone other than the hijacked account.
• The payload. Where the token can write, a 1,500-line shell script lands in a workflow, a CI script or an npm postinstall hook. OX Security counted 8,093 public repositories with a malicious commit on the default branch, 771 of them through postinstall. That route also runs on a developer laptop.
• The loot. Actions secrets, GITHUB_TOKEN, OIDC tokens, cloud credential files, SSH keys, registry tokens, and keys for OpenAI, Anthropic, Cursor, Copilot and Codex, per Aikido. It reads runner process memory too.
• The cleanup. The commit is reverted within a minute, and the workflow run and its logs are deleted. A missing run number is often the only trace.
• The backdoor. The script adds federated credentials named wfx-ci-… to Azure AD apps and rewrites AWS role trust policies to allow any account.

SecurityWeek reports that nobody has shown how the tokens were stolen.

Why wfx-loot matters for your business

Your CI pipeline holds the keys to production: the cloud role that deploys, the Stripe key, the AI API key with your card behind it. One contractor with write access and a stolen token is enough. Run this check today:

1. Search your org for the PR title, the wfx-docs branch, and commits named ci: refresh build cache, chore: add ci helper, ci: restore or ci: cleanup since November 10.
2. Look for gaps in workflow run numbers. Deleted runs leave holes.
3. If anything hits, treat every secret and cloud role that workflow could reach as stolen. Revoke and rotate all of them.
4. Then hunt persistence. Check Azure for wfx-ci-* federated credentials, and AWS for role trust policies with "AWS": "*" and sessions named wfx-*.
5. Cut standing access. Remove old collaborators and bot tokens with write. Pin Actions to commit SHAs while you're in there.

Sources: Aikido, OX Security, SecurityWeek.