{"id":"CMP-202611-hdanqh","kind":"campaign","aliases":[],"related":["CMP-202610-ghostaction-uses-stolen-github-tokens-to-plant-credential-st"],"title":"Stolen GitHub accounts plant the 'wfx' CI secret stealer in thousands of repos, then delete the run logs; it steals Actions secrets and cloud logins and leaves AWS and Azure backdoors (Aikido)","description":null,"summary":"Since about 12:45 UTC on 2026-11-10, an attacker has been using stolen GitHub logins. Aikido counted 4,837 hijacked accounts that opened a probe pull request ('docs: dependency audit notes' from a 'wfx-docs' branch) in 61,764 repositories, 10,431 of them reached through collaborator or organization access. In at least 1,806 repos the attacker then pushed a ~1,500-line shell stealer, which self-labels 'wfx', in one of three ways: injected into an existing workflow, as a package.json postinstall hook, or as a new workflow on a throwaway branch. The payload ran, and the attacker reverted within a minute and deleted the workflow run and its logs. The stealer takes GitHub Actions secrets and variables, GITHUB_TOKEN, OIDC and runtime tokens, AWS/GCP/Azure/Docker/Kubernetes/npm/PyPI/Vault/Terraform/SSH credentials, AI tool keys (OpenAI, Anthropic, Gemini, Hugging Face, Cursor, Copilot and others) and runner process memory, plus instance metadata on self-hosted runners. It uses OIDC to get into AWS, GCP and Azure, creates IAM access keys, and leaves backdoors that survive rotation: it forges passing status checks to get past branch protection, rewrites AWS role trust policies to Principal AWS '*', and adds Azure federated identity credentials named 'wfx-ci-...'. Confirmed tainted packages: Packagist digitalelvis/neuronai-studio 3.14.3, and Go module github.com/onuragtas/docker-env v1.0.278 and v1.0.280 (workflow file only). At least 50 hijacked accounts publish packages on npm, Go, Packagist, PyPI or crates; whether more packages are tainted is unknown. Private repos may be hit too (the payload has a private-repo mode). Many of the accounts were also hit in October's GhostAction wave, but Aikido does not say it is the same actor.","severity":"critical","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-12T06:52:27+00:00","products":[{"name":"GitHub Actions","note":"repos pushed to with stolen accounts since 2026-11-10","fixed":[],"ecosystem":"vendor"},{"name":"GitHub","note":"accounts with stolen tokens; probe PR docs: dependency audit notes","fixed":[],"ecosystem":"vendor"},{"name":"AWS IAM","note":"roles reachable via GitHub OIDC; trust policy rewritten to *","fixed":[],"ecosystem":"vendor"},{"name":"Microsoft Entra ID","note":"federated identity credentials wfx-ci-* added to apps","fixed":[],"ecosystem":"vendor"},{"name":"Google Cloud IAM","note":"service account impersonation","fixed":[],"ecosystem":"vendor"},{"name":"digitalelvis/neuronai-studio","fixed":[],"affected":"= 3.14.3","ecosystem":"packagist"},{"name":"github.com/onuragtas/docker-env","fixed":[],"affected":"v1.0.278, v1.0.280","ecosystem":"go"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"- In every repo you can write to, from 2026-11-10 on: look for a 'wfx-docs' branch or a pull request titled 'docs: dependency audit notes'. Look for branches 'chore/' + 8 random characters or 'ci-check-' + 4 digits. Look for commits 'ci: refresh build cache', 'ci: restore', 'chore: add ci helper', 'ci: cleanup' or 'chore: add dependency audit workflow'. Look for .github/workflows/build-audit-*.yml, a .ci-*.sh script with a postinstall hook in package.json, and workflow steps 'Pass runtime' / 'Restore cache ...' with WF_CALLBACK, WF_SECRETS or WF_CTOKEN env vars. If the probe PR is there, treat the account as compromised.\\n- A missing workflow run number around the attacker's commit is the most reliable sign the payload ran. No 'wfx-loot' artifacts, 'wfx-' cache entries or 'WFX-BEGIN' step summaries does not mean nothing was taken.\\n- Network: outbound connections to 194.150.166[.]244:8080 or 18.143.168[.]96:8080 (/exfil).\\n- AWS: IAM role trust policies with Principal {\"AWS\": \"*\"}, unexpected iam:CreateAccessKey calls, and AssumeRoleWithWebIdentity from token.actions.githubusercontent.com. Azure AD: federated identity credentials named 'wfx-ci-...'. GCP: generateAccessToken/signJwt on service accounts you don't expect.\\n- Dependencies: Packagist digitalelvis/neuronai-studio 3.14.3; Go github.com/onuragtas/docker-env v1.0.278 / v1.0.280.\\n- Stealer script SHA-256: 89695abb392d5cfd4972672961e644bb46baa98aa1ed7173c2a2816c762735cf.","fix":"- Revoke the affected account's PATs, OAuth grants and SSH keys, and close or delete the probe PRs and the wfx-docs / chore/* branches.\\n- If the payload ran, rotate every Actions secret and variable, and every cloud role and credential the repo's workflows could reach.\\n- Remove the backdoors: reset AWS role trust policies that allow '*', delete IAM access keys you didn't create, and delete Azure federated credentials named wfx-ci-*. Review GCP service account impersonation.\\n- Restrict OIDC trust to specific repos and branches. Require approval for workflow changes. Require status checks from a specific app, not just a context name.\\n- Remove digitalelvis/neuronai-studio 3.14.3 and treat any machine that installed it as compromised. Move off docker-env v1.0.278/v1.0.280.\\n- Block 194.150.166[.]244 and 18.143.168[.]96.","status":"open","published_at":"2026-11-12T00:00:00+00:00","first_seen_at":"2026-11-12T06:52:27+00:00","triaged_at":"2026-11-12T06:52:27+00:00","updated_at":"2026-11-12T06:52:43+00:00","category":"package","confidence":null,"triage":{"cause":{"at":"2026-11-12T06:57:40Z","path":"tampered-install","entry":"stolen-credential","reason":"The summary says the attacker has been 'using stolen GitHub logins' to open probe PRs and push the stealer, and confirmed tainted packages such as Packagist digitalelvis/neuronai-studio 3.14.3 carried the attacker's code to users who installed them.","confidence":0.85}},"analyst_status":"done","analyst_note":null,"search":"'-10':63B '-11':62B '-202611':34A '/onuragtas/docker-env':50A,270B '1':111B,119B '10':98B '12':57B '2026':61B '3.14.3':264B '4':74B '431':99B '45':58B '50':279B '500':120B '61':95B '764':96B '806':112B '837':75B 'access':107B,223B 'account':3A,77B,281B,315B 'action':21A,175B 'actions':37A 'actor':333B 'add':250B 'ai':187B 'aikido':32A,72B,325B 'also':317B 'anthrop':191B 'attack':65B,115B,158B 'audit':86B 'aw':28A,217B,242B,248B 'aws':39A 'aws/gcp/azure/docker/kubernetes/npm/pypi/vault/terraform/ssh':185B 'azur':30A,220B,251B 'backdoor':31A,227B 'branch':93B,152B,239B 'campaign':51B 'check':235B 'ci':7A,258B 'cloud':24A,45A 'cmp':33A 'collabor':104B 'confirm':259B 'copilot':196B 'count':73B 'crate':290B 'creat':221B 'credenti':186B,254B 'cursor':195B 'delet':15A,164B 'depend':85B 'digitalelvis/neuronai-studio':47A,263B 'doc':84B,92B 'earli':53B 'early-warn':52B 'entra':42A 'exist':137B 'face':194B 'feder':252B 'file':275B 'forg':232B 'gcp':218B 'gemini':192B 'get':215B,237B 'ghostact':322B 'github':2A,36A,38A,70B,174B,179B 'github.com':49A,269B 'github.com/onuragtas/docker-env':48A,268B 'go':266B,286B 'google':44A 'hdanqh':35A 'hijack':76B,280B 'hit':302B,318B 'hook':143B 'host':209B 'hug':193B 'iam':40A,46A,222B 'id':43A 'ident':253B 'inject':134B 'instanc':204B 'key':189B,224B 'label':127B 'least':110B,278B 'leav':27A,226B 'line':121B 'log':18A,170B 'login':25A,71B 'mani':312B 'may':300B 'memori':202B 'metadata':205B 'microsoft':41A 'minut':162B 'mode':311B 'modul':267B 'name':255B 'new':147B 'note':87B 'npm':285B 'octob':320B 'oidc':181B,213B 'one':130B 'open':79B 'openai':190B 'organ':106B 'other':198B 'packag':261B,283B,293B 'package.json':141B 'packagist':262B,287B 'pass':233B 'past':238B 'payload':154B,305B 'plant':4A 'plus':203B 'polici':245B 'postinstal':142B 'princip':247B 'privat':298B,309B 'private-repo':308B 'probe':81B 'process':201B 'protect':240B 'publish':282B 'pull':82B 'push':117B 'pypi':288B 'ran':155B 'reach':102B 'repo':13A,113B,299B,310B 'repositori':97B 'request':83B 'revert':159B 'rewrit':241B 'role':243B 'rotat':230B 'run':17A,167B 'runner':200B,210B 'runtim':183B 'say':328B 'secret':8A,22A,176B 'self':126B,208B 'self-host':207B 'self-label':125B 'shell':122B 'sinc':55B 'status':234B 'steal':20A 'stealer':9A,123B,172B 'stolen':1A,69B 'surviv':229B 'taint':260B,295B 'take':173B 'thousand':11A 'three':132B 'throwaway':151B 'token':180B,184B 'tool':188B 'trust':244B 'unknown':297B 'use':68B,212B 'utc':59B 'v1.0.278':271B 'v1.0.280':273B 'variabl':178B 'warn':54B 'wave':323B 'way':133B 'wfx':6A,91B,128B,257B 'wfx-ci':256B 'wfx-doc':90B 'whether':291B 'within':160B 'workflow':138B,148B,166B,274B","nicknames":["wfx"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["actions","awsiam","cloudiam","digitalelvisneuronaistudio","entraid","github","githubactions","githubcomonuragtasdockerenv","googlecloudiam","iam","microsoftentraid","wfx"],"ptokens":["actions","aws","cloud","com","digitalelvis","docker","entra","env","github","google","iam","id","microsoft","neuronai","onuragtas","studio"],"labels":["campaign","critical","earlywarning","package"],"campaign_type":"breach","search_a":"'-202611':34A '/onuragtas/docker-env':50A 'account':3A 'action':21A 'actions':37A 'aikido':32A 'aw':28A 'aws':39A 'azur':30A 'backdoor':31A 'ci':7A 'cloud':24A,45A 'cmp':33A 'delet':15A 'digitalelvis/neuronai-studio':47A 'entra':42A 'github':2A,36A,38A 'github.com':49A 'github.com/onuragtas/docker-env':48A 'google':44A 'hdanqh':35A 'iam':40A,46A 'id':43A 'leav':27A 'log':18A 'login':25A 'microsoft':41A 'plant':4A 'repo':13A 'run':17A 'secret':8A,22A 'steal':20A 'stealer':9A 'stolen':1A 'thousand':11A 'wfx':6A","search_b":"'-10':63B '-11':62B '/onuragtas/docker-env':270B '1':111B,119B '10':98B '12':57B '2026':61B '3.14.3':264B '4':74B '431':99B '45':58B '50':279B '500':120B '61':95B '764':96B '806':112B '837':75B 'access':107B,223B 'account':77B,281B,315B 'action':175B 'actor':333B 'add':250B 'ai':187B 'aikido':72B,325B 'also':317B 'anthrop':191B 'attack':65B,115B,158B 'audit':86B 'aw':217B,242B,248B 'aws/gcp/azure/docker/kubernetes/npm/pypi/vault/terraform/ssh':185B 'azur':220B,251B 'backdoor':227B 'branch':93B,152B,239B 'campaign':51B 'check':235B 'ci':258B 'collabor':104B 'confirm':259B 'copilot':196B 'count':73B 'crate':290B 'creat':221B 'credenti':186B,254B 'cursor':195B 'delet':164B 'depend':85B 'digitalelvis/neuronai-studio':263B 'doc':84B,92B 'earli':53B 'early-warn':52B 'exist':137B 'face':194B 'feder':252B 'file':275B 'forg':232B 'gcp':218B 'gemini':192B 'get':215B,237B 'ghostact':322B 'github':70B,174B,179B 'github.com':269B 'github.com/onuragtas/docker-env':268B 'go':266B,286B 'hijack':76B,280B 'hit':302B,318B 'hook':143B 'host':209B 'hug':193B 'iam':222B 'ident':253B 'inject':134B 'instanc':204B 'key':189B,224B 'label':127B 'least':110B,278B 'leav':226B 'line':121B 'log':170B 'login':71B 'mani':312B 'may':300B 'memori':202B 'metadata':205B 'minut':162B 'mode':311B 'modul':267B 'name':255B 'new':147B 'note':87B 'npm':285B 'octob':320B 'oidc':181B,213B 'one':130B 'open':79B 'openai':190B 'organ':106B 'other':198B 'packag':261B,283B,293B 'package.json':141B 'packagist':262B,287B 'pass':233B 'past':238B 'payload':154B,305B 'plus':203B 'polici':245B 'postinstal':142B 'princip':247B 'privat':298B,309B 'private-repo':308B 'probe':81B 'process':201B 'protect':240B 'publish':282B 'pull':82B 'push':117B 'pypi':288B 'ran':155B 'reach':102B 'repo':113B,299B,310B 'repositori':97B 'request':83B 'revert':159B 'rewrit':241B 'role':243B 'rotat':230B 'run':167B 'runner':200B,210B 'runtim':183B 'say':328B 'secret':176B 'self':126B,208B 'self-host':207B 'self-label':125B 'shell':122B 'sinc':55B 'status':234B 'stealer':123B,172B 'stolen':69B 'surviv':229B 'taint':260B,295B 'take':173B 'three':132B 'throwaway':151B 'token':180B,184B 'tool':188B 'trust':244B 'unknown':297B 'use':68B,212B 'utc':59B 'v1.0.278':271B 'v1.0.280':273B 'variabl':178B 'warn':54B 'wave':323B 'way':133B 'wfx':91B,128B,257B 'wfx-ci':256B 'wfx-doc':90B 'whether':291B 'within':160B 'workflow':138B,148B,166B,274B","search_c":"","cause_entry":"stolen-credential","cause_path":"tampered-install","disclosures_checked_at":"2026-11-12T06:57:24+00:00","first_public_at":"2026-11-12T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-hdanqh","url":null,"severity":null,"published_at":"2026-11-12T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-11-12T06:52:27+00:00","fetched_at":"2026-11-12T06:52:27+00:00","note":null}],"documents":[{"id":132574,"url":"https://x.com/TheHackersNews/status/2120769833621180849","title":"@TheHackersNews: ⚠️ Over 4,800 stolen GitHub accounts used to plant a CI secret stealer that ran ","kind":"post","source":"x","publisher":null,"text":"⚠️ Over 4,800 stolen GitHub accounts used to plant a CI secret stealer that ran in at least 1,806 repositories.\n\nThe malware targeted #GitHub secrets and cloud credentials. Attackers reverted malicious commits within a minute and usually deleted workflow logs.\n\nDetails → https://t.co/KKrozlXNoR\n\nlikes 15 reposts 2","published_at":"2026-11-12T06:45:04+00:00","relation":"describes","confidence":null,"note":null},{"id":130989,"url":"https://www.aikido.dev/blog/compromised-github-accounts-push-ci-secret-stealer-to-tens-of-thousands-of-repositories","title":"Compromised GitHub accounts push CI secret stealer to tens of thousands of repositories","kind":"blog","source":"blog","publisher":null,"text":"Aikido Security (Oliver Smith), Nov 12 2026: Compromised GitHub accounts push CI secret stealer (\"wfx\") to tens of thousands of repositories. Since ~12:45 UTC Nov 10, 4,837 compromised accounts opened probe PRs \"docs: dependency audit notes\" from branch wfx-docs in 61,764 repos (10,431 via collaborator/org access; 92% still open). Payload ran in at least 1,806 repos. Variants: \"ci: refresh build cache\" workflow injection (~1,500 lines); \"chore: add ci helper\" adds .ci-xxxxxx.sh + package.json postinstall; \"chore: add dependency audit workflow\" adds .github/workflows/build-audit-xxxxxx.yml on chore/xxxxxxxx branch. Reverts within a minute and deletes the workflow run/logs. Steals Actions secrets/vars, GITHUB_TOKEN, OIDC/runtime tokens, cloud/registry/AI tool credentials, runner process memory, IMDS on self-hosted. Escalates via OIDC to AWS/GCP/Azure, iam:CreateAccessKey, Vault, Kubernetes. Persists: forged success status checks to bypass branch protection; AWS role trust policy set to Principal AWS \"*\"; Azure federated identity credentials named wfx-ci-... Exfil HTTP POST to 194.150.166[.]244:8080/exfil, 18.143.168[.]96:8080/exfil. Packages: Packagist digitalelvis/neuronai-studio 3.14.3; Go github.com/onuragtas/docker-env v1.0.278, v1.0.280 (workflow file only). Branches wfx-docs, chore/[a-z0-9]{8}, ci-check-[0-9]{4}; commits ci: refresh build cache, ci: restore, chore: add ci helper, ci: cleanup, chore: add dependency audit workflow. Script SHA-256 89695abb392d5cfd4972672961e644bb46baa98aa1ed7173c2a2816c762735cf. Account overlap with October GhostAction, not attributed to same actor.\n","published_at":"2026-11-12T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}