Hijacked GitHub Accounts Plant a CI Secret Stealer, Then Wipe Logs

Since November 10, 2026, an attacker with stolen tokens for 4,837 GitHub accounts has probed more than 60,000 repositories for write access, then pushed a credential stealer wherever it could. Aikido Security, which named the campaign wfx-loot, says the payload exfiltrated secrets from more than 1,800 repositories. No GitHub bug was used, just valid developer and bot tokens.

The cleanup sets it apart. Within about a minute, the attacker reverted each commit and deleted the workflow run and its logs. The script takes Actions secrets, runner memory, and cloud and AI service keys, and tries to stay in AWS and Azure accounts after rotation. Automated publishing also carried it into a Packagist package and Go modules.

From about 05:30 UTC on November 12, new copies sent stolen data only to Telegram, so blocking known IP addresses stopped working. Anyone who finds a “docs: dependency audit notes” pull request should treat every reachable secret as stolen, rotate it, revoke the account’s tokens, and remove any cloud persistence the stealer added.

Source: SecurityWeek