Menu
Breach Value Calculator

GitHub Actions Secret Stealer wfx-loot: Check Repos, Rotate Secrets

Hijacked GitHub accounts opened \"docs: dependency audit notes\" pull requests in 61,764 repositories. How to check for wfx-loot and what to rotate.

By CyphrQ.ai

Written with AI assistance and human editorial review. Every figure linked to its source.

Published 3 min read

Hijacked GitHub accounts opened "docs: dependency audit notes" pull requests in 61,764 repositories on 10 and 11 November 2026, then pushed code that steals GitHub Actions secrets and cloud credentials. If that title or the branches below appeared in a repository you can write to, treat the account as compromised and rotate every secret its workflows could reach.

Sources checked 12 November 2026.

What happened: a GitHub Actions secret stealer

Aikido Security, which tracks the campaign as wfx-loot, says in its 12 November write-up that "a threat actor used stolen GitHub credentials to push a malicious workflow payload". It doesn't say how they were stolen.

  • Scale: 4,837 compromised accounts, between 10 November, 12:45 UTC, and 11 November, 15:00 UTC.
  • Probe, then payload: the pull request "confirms write access"; later commits carry the payload, and the attacker "reverts within at most one minute and deletes the workflow run, along with its logs."
  • Confirmed theft: "At least 1,835 repositories ran the payload and have had credentials exfiltrated."
  • Mostly unnoticed: of 10,431 pull requests into repositories the account doesn't own, "92% of them are still open".

The payload collects "GitHub Actions secrets and variables, the workflow GITHUB_TOKEN, and the OIDC and Actions runtime tokens", plus cloud and SSH credential files and runner process memory. It turns OIDC tokens into AWS, GCP and Azure sessions, adds Azure AD federated credentials named wfx-ci-…, and forges success status checks, so a green check from that window proves nothing.

Aikido says the accounts overlap with October's GhostAction wave but assesses "distinct campaigns likely carried out by different threat actors"; no actor is named. We found no GitHub statement on 12 November 2026.

Who is affected

Aikido: "You may be affected if any of these appeared in a repository you can write to on or after November 10":

  • the pull request title docs: dependency audit notes;
  • branches wfx-docs, chore/ followed by eight random characters, or ci-check- followed by four digits;
  • commit messages ci: refresh build cache, chore: add ci helper, chore: add dependency audit workflow, ci: restore or ci: cleanup;
  • a .ci-xxxxxx.sh script with a postinstall hook in package.json, or a workflow named .github/workflows/build-audit-xxxxxx.yml.

Aikido adds: "If the probe ran, that user is compromised, even if the workflow stage did not run." At least 50 of the compromised users publish packages to npm, Go, Packagist, PyPI or crates; the write-up names the affected package versions.

What to do now

  1. Search for the indicators in every repository you can write to, from 10 November onward. "A missing run number in the workflow's history is often the only trace," Aikido says.
  2. Rotate. Aikido: "If the payload ran in your repository, assume every secret and cloud role available to its workflows is compromised." In our view, also reset the account's password, personal access tokens and sessions.
  3. Check your cloud accounts for AWS role trust policies set to "Principal": {"AWS": "*"}, new IAM access keys, and Azure AD federated credentials named wfx-ci-.
  4. Shrink the blast radius. GitHub's secure use reference advises setting "the default permission for the GITHUB_TOKEN to read access only for repository contents", using CODEOWNERS so changes to workflow files "first require approval from a designated reviewer", and OpenID Connect so you "stop storing these credentials as long-lived secrets". Our CI/CD pipeline guide covers protected environments and OIDC trust conditions.
  5. Tell your users if you publish packages from an affected account, and say which versions to remove. Our Hugging Face Spaces case file covers a 2024 pipeline-secrets incident.

Sources

Spotted a mistake? Report a correction.