Aikido reports that attackers used stolen GitHub credentials to test repository access and insert workflows that steal build secrets. The security vendor calls the campaign wfx-loot. It says the activity began November 10 and that credentials were taken from repositories where the payload ran. BleepingComputer’s Bill Toulas also reported the investigation.
The attacker used compromised accounts to open probe pull requests, then pushed a malicious workflow or install hook where permissions allowed. A probe is a warning that the account needs investigation; it does not by itself show that the payload ran. Aikido says the attacker often reverted changes and deleted workflow runs and logs within a minute.
Who should check
Repository owners should look for a wfx-docs branch or a pull request titled docs: dependency audit notes created on or after November 10. Review unexpected workflow changes and gaps in run numbers too. Missing logs are a reason to investigate, not proof of compromise. Aikido’s indicators are specific to the activity it observed and may not catch variants.
Where execution is confirmed, treat secrets and cloud roles available to the workflow as compromised. Revoke and replace affected credentials, inspect account and organization audit records, and review cloud access for unauthorized changes. Aikido describes code capable of creating lasting credentials or changing cloud trust settings where its permissions allow. Credential rotation alone may leave that access in place.
Review self-hosted runners and their accessible credentials as part of the investigation. The payload can reach beyond repository secrets to credentials and metadata available on those machines. Preserve available evidence and follow incident-response procedures before rebuilding affected runners.
Package exposure differs
Aikido identifies Packagist digitalelvis/neuronai-studio 3.14.3 and Go module github.com/onuragtas/docker-env v1.0.278 and v1.0.280 as affected releases. It recommends treating machines that installed or opened the Packagist release as compromised. For the two Go tags, it says the malicious code was confined to a GitHub Actions workflow; ordinary Go builds do not run that workflow. Review use of the package and any workflows separately.
Aikido reports 4,837 compromised accounts probing 61,764 repositories. Its article gives different figures for repositories where the payload ran, so those counts should be treated as preliminary. The vendor sells security products; its investigation is the source for the campaign’s scope and impact.