GitHub 'wfx-loot' secret stealer hits 61,764 repositories

The figures require careful reading, because different numbers describe different parts of the campaign. Aikido reports that 4,837 hijacked GitHub accounts opened probe pull requests in 61,764 repositories. The probe requests carried a consistent signature: the title "docs: dependency audit notes", from branches named "wfx-docs". Between 12:45 UTC on 10 November and 15:00 UTC on 11 November, Aikido counted 61,839 such pull requests. A fourth wave began at 01:00 UTC on 12 November and was still running at 09:08 UTC that day. At that point, 92 percent of the probe pull requests remained open.

The scale of the campaign

The 61,764 repositories are the repositories that received a probe pull request. The 61,839 pull requests are the number of probe requests opened in the first two waves. The figure for repositories where the payload actually ran is smaller: at least 1,806, according to Aikido. The payload runs only when a probe pull request is merged and the repository's workflow executes, so far fewer repositories saw the payload run than received a request.

One further figure requires a note. Aikido's own reporting gives two numbers for the repositories where the payload ran: a summary figure of 1,835 and a figure of 1,806 in the body of its report. This article uses 1,806, the figure stated in the body of the report, as a lower bound. The discrepancy has not been explained, and the true number may be higher, since the campaign was still running when the report was published. A separate count from Cycode recorded 64,614 probe pull requests in public repositories as of 09:08 UTC on 12 November. That figure counts pull requests, not repositories, and covers public repositories only.

How the attack works

The attack began at approximately 12:45 UTC on 10 November 2026. Compromised GitHub accounts opened pull requests titled "docs: dependency audit notes" from branches named "wfx-docs". The pull requests were probes: merging one caused the repository's continuous integration workflow to run code supplied by the attacker. The payload executed inside the GitHub Actions runner, the environment in which a repository's automated checks and builds run.

The first waves ran from 12:45 UTC on 10 November to 15:00 UTC on 11 November, producing 61,839 probe pull requests. A fourth wave began at 01:00 UTC on 12 November and continued past 09:08 UTC. With 92 percent of the probe pull requests still open, each one remains a live opportunity for a maintainer to merge it and trigger the payload.

What the payload steals

The payload targets the secrets that a continuous integration environment holds. According to Aikido, it collects GitHub Actions secrets and variables, the GITHUB_TOKEN issued to the workflow, and OpenID Connect and Actions runtime tokens. It also collects cloud credentials for Amazon Web Services, Microsoft Azure and Google Cloud Platform, and tokens for artificial intelligence tools, including OpenAI, Anthropic, Cursor, Copilot, Gemini and Hugging Face.

The payload also reads credential files, shell histories, files with the .env and .pem extensions, and the memory of processes running on the runner. A single merged pull request can therefore expose credentials for other services as well as the repository itself.

Stolen data was exfiltrated over HTTP POST requests to two addresses: 194.150.166.244 on port 8080, at the path /exfil, and 18.143.168.96 on port 8080, at the same path. A variant that exfiltrates data through Telegram appeared at approximately 05:30 UTC on 12 November, which indicates that the operation was being adapted while it ran.

Spread into packages

The campaign also spread beyond pull requests into published software packages. The Packagist package digitalelvis/neuronai-studio, version 3.14.3, was found to contain the payload. Any machine that installed that version should be treated as compromised, and its credentials should be treated as exposed.

A Go module was also affected: github.com/onuragtas/docker-env, versions v1.0.278 and v1.0.280. In this case the payload was present only in a workflow file. The Go source code and the compiled binaries were unchanged, and Go builds do not execute workflow files, so installing the module did not run the payload. A compromised workflow file in a package is a risk to the package's own continuous integration environment, not to every user who installs the package, and the two cases should not be described in the same terms.

Attribution and the GhostAction question

The campaign follows an earlier incident in October 2026, known as GhostAction, in which a similar technique was used to steal secrets through pull requests. Aikido assesses that "wfx-loot" is likely the work of a different actor. The assessment rests on differences in infrastructure, tooling and tradecraft between the two campaigns. The accounts hit by the two campaigns overlap, but Aikido treats that overlap as consistent with the reuse of previously compromised accounts rather than as evidence of a single actor.

No official statement from GitHub has been published on the campaign at the time of writing. Any claim that GitHub has responded should be treated as unverified until such a statement appears.

Why it matters

The incident matters for three reasons. First, the pull request workflow, the normal mechanism by which open source projects accept contributions, can be turned into a delivery channel for credential theft at scale: a single click by a maintainer can expose an entire set of secrets. Second, the payload targets the credentials that connect a repository to the rest of a developer's infrastructure, so the compromise of one repository can become the compromise of the services around it. Third, the campaign was still running when it was reported, with a fourth wave in progress and the large majority of probe pull requests still open.

What happens next

The immediate step for maintainers is to check whether any pull request titled "docs: dependency audit notes" from a "wfx-docs" branch has been merged into their repositories, and to treat any merged request as a compromise. Credentials that could have been exposed, including GitHub Actions secrets, cloud credentials and tokens for artificial intelligence tools, should be rotated. Machines that installed digitalelvis/neuronai-studio version 3.14.3 should be treated as compromised.

The wider question is how the platform and the open source community respond to a technique used in two large campaigns within weeks. Aikido's assessment that the two campaigns were run by different actors suggests that the technique itself, rather than a single group, is the problem. Until the pull request workflow is better protected against this form of abuse, the same pattern is likely to appear again.