AnswersPublished25 sources
How the wfx-loot Campaign Used Stolen GitHub Accounts to Target 61,764 Repositories
wfx loot used stolen GitHub credentials—not a GitHub Actions vulnerability—to test write access across 61,764 repositories. Aikido's published count is 1,835 affected repositories, while some reports cite an earlier 1,806.
Published byEdited with GPT-6 LunaImages generated with GPT Image 2
Research answer
Key takeaways
- wfx loot used stolen GitHub credentials—not a GitHub Actions vulnerability—to test write access across 61,764 repositories.
- Aikido's published count is 1,835 affected repositories, while some reports cite an earlier 1,806.
AI Prompt
openai.comCreate a landscape editorial hero image for this Studio Global article: What was the wfx-loot GitHub credential-theft campaign reported by Aikido Security, when did it begin and how long was it active, how did at. Article summary: wfx-loot was a mass CI credential-theft campaign that used valid stolen GitHub credentials—not a GitHub Actions vulnerability—to place secret-stealing code in repositories the compromised accounts could write to. Aikido . Topic tags: general, general web. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks, charts with fake numbers, clic
wfx-loot was a credential-theft campaign that used compromised GitHub accounts to probe repositories and, where the accounts had write access, introduce code designed to steal secrets from continuous-integration (CI) environments. Aikido reported 4,837 compromised accounts and pull requests in 61,764 repositories; its published tally said the payload ran and credentials were exfiltrated from at least 1,835 repositories.4
9
When did wfx-loot happen, and how long did it last?
The activity began around 12:45 UTC on November 10, 2026. A report places the probe-pull-request window through 15:00 UTC on November 11—about 26 hours and 15 minutes.6
7 That is the observed window for the probes, not confirmation that all payload activity or later use of stolen credentials stopped then.
The campaign’s scale figures describe different stages:
- 4,837 accounts were reported as compromised.
- 61,764 repositories received probe pull requests. That is a count of repositories tested, not repositories where malware is known to have run.
- At least 1,835 repositories were included in Aikido’s published count of payload execution and credential exfiltration.
9
Some contemporaneous reports cited a lower figure of 1,806.6
10 The available reports do not explain the difference, so the counts should be treated as separate reported tallies rather than combined. The supplied reporting also does not substantiate the later claim of roughly 1,970 confirmed public cases among more than 66,000 targets.
How the attackers tested access
The attackers opened pull requests titled docs: dependency audit notes from branches named wfx-docs. The requests acted as probes: they tested whether a compromised account could write to the target repository.3
4
9
Where access permitted, the attackers introduced a secret-stealing payload into the CI environment. The campaign relied on valid stolen credentials, rather than a vulnerability in GitHub Actions.4
9 OX Security described the malware as a single shell script of roughly 1,500 lines.
31
Reports describe malicious changes and workflow logs being removed in some cases, making investigation harder.1
6 The available evidence supports the general pattern of probing, payload execution and cleanup; it does not establish every reported deployment method or commit message as part of every infection.
What the payload targeted
The documented objective was to collect credentials available to CI jobs, including GitHub Actions secrets and cloud credentials. Reporting also describes attempts to obtain AI-service tokens.3
9 OX Security’s analysis lists credentials for AWS, Azure and Google Cloud among the targets.
31 Separate reporting says the malware could search runner process memory for secrets, although the supplied excerpts do not establish how often that method succeeded.
17
29
A retrieved summary describes attempts to extend access through AWS trust-policy changes and Azure federated credentials.5 Treat those persistence details as reported behavior, not proof that every affected repository—or every cloud account—was modified. The evidence centers on credential theft; it does not demonstrate theft of source code or customer databases.
9
15
What the reported signals do—and don’t—show
One report said 92% of the 10,431 probe pull requests made through collaborator or organization access remained open when checked.10
19 That suggests many probes had not been acted on by then, but it does not establish that no repository owner or security team had detected them. The percentage should not be read as applying to all pull requests.
An investigation playbook also reported 173 probe pull requests from 19 accounts using tokens through the Fly.io GitHub App. That observation does not, by itself, show that Fly.io’s infrastructure was breached or that the payload ran in every repository reached through those tokens.37
What defenders should check
If your organization may have been exposed, distinguish probed, payload inserted, payload executed and credentials exfiltrated in your incident assessment. They are not interchangeable findings.
- Search for probe indicators. Review pull requests titled
docs: dependency audit notesand branches namedwfx-docsin repositories your accounts could write to. - Review CI and audit records. Check workflow runs, commits, branch activity and available cloud logs. Missing workflow run numbers may be a lead because reports describe deleted runs and logs, but a gap alone does not prove compromise.
1
24
- Revoke affected access. Revoke suspected compromised GitHub tokens and review account, collaborator and GitHub App access.
- Rotate exposed secrets broadly. If the payload ran, treat secrets and cloud roles available to that workflow as potentially compromised—not just credentials visible in surviving logs.
3
- Look for cloud persistence. Investigate unexpected AWS trust-policy changes and Azure application or federated-credential changes, as well as unauthorized keys or other access changes.
5
- Preserve evidence. Save remaining audit records and logs before making cleanup changes, then record which stage of the attack is supported by evidence.
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
People also ask
What is the short answer to "How the wfx-loot Campaign Used Stolen GitHub Accounts to Target 61,764 Repositories"?
wfx loot used stolen GitHub credentials—not a GitHub Actions vulnerability—to test write access across 61,764 repositories.
What are the key points to validate first?
wfx loot used stolen GitHub credentials—not a GitHub Actions vulnerability—to test write access across 61,764 repositories. Aikido's published count is 1,835 affected repositories, while some reports cite an earlier 1,806.
Sources
bleepingcomputer.comHackers compromise 4,800 GitHub accounts to steal cloud credentials
al-ice.aiProbe, Payload, Vanish: 4,837 Hijacked GitHub Accounts Fed a CI Secret Stealer Across 61,764 Repositories
unbiasedheadlines.comStolen Logins for 4,837 GitHub Accounts Used to Run Secret Stealer in at Least 1,806 Repositories, Researchers Say