Stolen GitHub accounts plant the 'wfx' CI secret stealer in thousands of repos, then delete the run logs; it steals Actions secrets and cloud logins and leaves AWS and Azure backdoors (Aikido)

Since about 12:45 UTC on 2026-11-10, an attacker has been using stolen GitHub logins. Aikido counted 4,837 hijacked accounts that opened a probe pull request ('docs: dependency audit notes' from a 'wfx-docs' branch) in 61,764 repositories, 10,431 of them reached through collaborator or organization access. In at least 1,806 repos the attacker then pushed a ~1,500-line shell stealer, which self-labels 'wfx', in one of three ways: injected into an existing workflow, as a package.json postinstall hook, or as a new workflow on a throwaway branch. The payload ran, and the attacker reverted within a minute and deleted the workflow run and its logs. The stealer takes GitHub Actions secrets and variables, GITHUB_TOKEN, OIDC and runtime tokens, AWS/GCP/Azure/Docker/Kubernetes/npm/PyPI/Vault/Terraform/SSH credentials, AI tool keys (OpenAI, Anthropic, Gemini, Hugging Face, Cursor, Copilot and others) and runner process memory, plus instance metadata on self-hosted runners. It uses OIDC to get into AWS, GCP and Azure, creates IAM access keys, and leaves backdoors that survive rotation: it forges passing status checks to get past branch protection, rewrites AWS role trust policies to Principal AWS '*', and adds Azure federated identity credentials named 'wfx-ci-...'. Confirmed tainted packages: Packagist digitalelvis/neuronai-studio 3.14.3, and Go module github.com/onuragtas/docker-env v1.0.278 and v1.0.280 (workflow file only). At least 50 hijacked accounts publish packages on npm, Go, Packagist, PyPI or crates; whether more packages are tainted is unknown. Private repos may be hit too (the payload has a private-repo mode). Many of the accounts were also hit in October's GhostAction wave, but Aikido does not say it is the same actor.