--- id: "CMP-202611-hdanqh" page: "https://infrastack.ai/live/CMP-202611-hdanqh" kind: "campaign" aliases: [] title: "Stolen GitHub accounts plant the 'wfx' CI secret stealer in thousands of repos, then delete the run logs; it steals Actions secrets and cloud logins and leaves AWS and Azure backdoors (Aikido)" severity: "critical" cvss: null epss: null exploited: true status: "open" category: "package" products: [{"name": "GitHub Actions", "note": "repos pushed to with stolen accounts since 2026-11-10", "fixed": [], "ecosystem": "vendor"}, {"name": "GitHub", "note": "accounts with stolen tokens; probe PR docs: dependency audit notes", "fixed": [], "ecosystem": "vendor"}, {"name": "AWS IAM", "note": "roles reachable via GitHub OIDC; trust policy rewritten to *", "fixed": [], "ecosystem": "vendor"}, {"name": "Microsoft Entra ID", "note": "federated identity credentials wfx-ci-* added to apps", "fixed": [], "ecosystem": "vendor"}, {"name": "Google Cloud IAM", "note": "service account impersonation", "fixed": [], "ecosystem": "vendor"}, {"name": "digitalelvis/neuronai-studio", "fixed": [], "affected": "= 3.14.3", "ecosystem": "packagist"}, {"name": "github.com/onuragtas/docker-env", "fixed": [], "affected": "v1.0.278, v1.0.280", "ecosystem": "go"}] ecosystems: [] tags: ["campaign", "early-warning"] not_affected_if: [] published_at: "2026-11-12T00:00:00+00:00" first_seen_at: "2026-11-12T06:52:27+00:00" updated_at: "2026-11-12T06:52:43+00:00" sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-11-12T06:52:27+00:00"}] exploit_sources: [] --- # Stolen GitHub accounts plant the 'wfx' CI secret stealer in thousands of repos, then delete the run logs; it steals Actions secrets and cloud logins and leaves AWS and Azure backdoors (Aikido) Link for people: https://infrastack.ai/live/CMP-202611-hdanqh (this .md is for agents) Since about 12:45 UTC on 2026-11-10, an attacker has been using stolen GitHub logins. Aikido counted 4,837 hijacked accounts that opened a probe pull request ('docs: dependency audit notes' from a 'wfx-docs' branch) in 61,764 repositories, 10,431 of them reached through collaborator or organization access. In at least 1,806 repos the attacker then pushed a ~1,500-line shell stealer, which self-labels 'wfx', in one of three ways: injected into an existing workflow, as a package.json postinstall hook, or as a new workflow on a throwaway branch. The payload ran, and the attacker reverted within a minute and deleted the workflow run and its logs. The stealer takes GitHub Actions secrets and variables, GITHUB_TOKEN, OIDC and runtime tokens, AWS/GCP/Azure/Docker/Kubernetes/npm/PyPI/Vault/Terraform/SSH credentials, AI tool keys (OpenAI, Anthropic, Gemini, Hugging Face, Cursor, Copilot and others) and runner process memory, plus instance metadata on self-hosted runners. It uses OIDC to get into AWS, GCP and Azure, creates IAM access keys, and leaves backdoors that survive rotation: it forges passing status checks to get past branch protection, rewrites AWS role trust policies to Principal AWS '*', and adds Azure federated identity credentials named 'wfx-ci-...'. Confirmed tainted packages: Packagist digitalelvis/neuronai-studio 3.14.3, and Go module github.com/onuragtas/docker-env v1.0.278 and v1.0.280 (workflow file only). At least 50 hijacked accounts publish packages on npm, Go, Packagist, PyPI or crates; whether more packages are tainted is unknown. Private repos may be hit too (the payload has a private-repo mode). Many of the accounts were also hit in October's GhostAction wave, but Aikido does not say it is the same actor. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:GitHub Actions affected range not listed fixed no fixed version listed - vendor:GitHub affected range not listed fixed no fixed version listed - vendor:AWS IAM affected range not listed fixed no fixed version listed - vendor:Microsoft Entra ID affected range not listed fixed no fixed version listed - vendor:Google Cloud IAM affected range not listed fixed no fixed version listed - packagist:digitalelvis/neuronai-studio affected = 3.14.3 fixed no fixed version listed - go:github.com/onuragtas/docker-env affected v1.0.278, v1.0.280 fixed no fixed version listed ## Cause How the attacker got in: a stolen credential that still worked (stolen-credential). The summary says the attacker has been 'using stolen GitHub logins' to open probe PRs and push the stealer, and confirmed tainted packages such as Packagist digitalelvis/neuronai-studio 3.14.3 carried the attacker's code to users who installed them. How it reached others: their users installed or auto-updated it (tampered-install). So it does not happen to you: List your long-lived credentials (GitHub tokens, cloud keys, app and service-principal secrets, CI secrets) with their last rotation; rotate anything older than 90 days or without an owner, and set expiry where it is offered. Last month's incidents with the same cause, and the full checklist: https://infrastack.ai/live/breaches.md#tampered-install ## How to check - In every repo you can write to, from 2026-11-10 on: look for a 'wfx-docs' branch or a pull request titled 'docs: dependency audit notes'. Look for branches 'chore/' + 8 random characters or 'ci-check-' + 4 digits. Look for commits 'ci: refresh build cache', 'ci: restore', 'chore: add ci helper', 'ci: cleanup' or 'chore: add dependency audit workflow'. Look for .github/workflows/build-audit-*.yml, a .ci-*.sh script with a postinstall hook in package.json, and workflow steps 'Pass runtime' / 'Restore cache ...' with WF_CALLBACK, WF_SECRETS or WF_CTOKEN env vars. If the probe PR is there, treat the account as compromised.\n- A missing workflow run number around the attacker's commit is the most reliable sign the payload ran. No 'wfx-loot' artifacts, 'wfx-' cache entries or 'WFX-BEGIN' step summaries does not mean nothing was taken.\n- Network: outbound connections to 194.150.166[.]244:8080 or 18.143.168[.]96:8080 (/exfil).\n- AWS: IAM role trust policies with Principal {"AWS": "*"}, unexpected iam:CreateAccessKey calls, and AssumeRoleWithWebIdentity from token.actions.githubusercontent.com. Azure AD: federated identity credentials named 'wfx-ci-...'. GCP: generateAccessToken/signJwt on service accounts you don't expect.\n- Dependencies: Packagist digitalelvis/neuronai-studio 3.14.3; Go github.com/onuragtas/docker-env v1.0.278 / v1.0.280.\n- Stealer script SHA-256: 89695abb392d5cfd4972672961e644bb46baa98aa1ed7173c2a2816c762735cf. ## Fix - Revoke the affected account's PATs, OAuth grants and SSH keys, and close or delete the probe PRs and the wfx-docs / chore/* branches.\n- If the payload ran, rotate every Actions secret and variable, and every cloud role and credential the repo's workflows could reach.\n- Remove the backdoors: reset AWS role trust policies that allow '*', delete IAM access keys you didn't create, and delete Azure federated credentials named wfx-ci-*. Review GCP service account impersonation.\n- Restrict OIDC trust to specific repos and branches. Require approval for workflow changes. Require status checks from a specific app, not just a context name.\n- Remove digitalelvis/neuronai-studio 3.14.3 and treat any machine that installed it as compromised. Move off docker-env v1.0.278/v1.0.280.\n- Block 194.150.166[.]244 and 18.143.168[.]96. ## Timeline - 2026-11-12T06:52:27+00:00 analyst ## Documents - [describes] @TheHackersNews: ⚠️ Over 4,800 stolen GitHub accounts used to plant a CI secret stealer that ran https://x.com/TheHackersNews/status/2120769833621180849 - [describes] Compromised GitHub accounts push CI secret stealer to tens of thousands of repositories https://www.aikido.dev/blog/compromised-github-accounts-push-ci-secret-stealer-to-tens-of-thousands-of-repositories --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_