wfx-loot Campaign Abuses More Than 4,800 GitHub Accounts to Steal Cloud and CI/CD Credentials

Security researchers disclosed a campaign named wfx-loot, which involved threat actors using 4,837 compromised GitHub accounts to target 61,764 code repositories. The objective was to steal secrets from GitHub Actions and access credentials for cloud environments. At least 1,835 repositories already had their secrets stolen. The campaign presents a significant software supply chain security risk because compromised accounts belonged to Fortune 100 companies, U.S. and French government organizations, and open-source projects like Nextcloud and WebdriverIO. Approximately 50 of the compromised accounts also held permissions to publish packages on major ecosystems such as npm, PyPI, Go, crates, and Packagist.
The attackers initiated the campaign on November 10, 2026, by creating a Pull Request titled docs: dependency audit notes to check for write permissions. Where writable repositories were found, malicious scripts were injected via GitHub Actions workflows or npm installation steps. This allowed the theft of tokens, cloud credentials for AWS, Azure, and Google Cloud, developer infrastructure credentials for Docker, Kubernetes, and Terraform, and API keys for AI services like OpenAI, Anthropic, Gemini, and GitHub Copilot. Attackers also used OIDC tokens to escalate privileges and establish persistent identities in cloud environments before exfiltrating data and deleting workflow execution history within one minute. Malicious code was also introduced into specific package versions on Packagist and the Go module repository. The campaign bears similarities to previous GhostAction activity, emphasizing the need for restricted token permissions and secure OIDC trust configurations.

* A campaign named wfx-loot involved threat actors targeting 61,764 code repositories using 4,837 compromised GitHub accounts.
* Secrets from GitHub Actions and cloud environment credentials were targeted for theft.
* Secrets were already stolen from at least 1,835 repositories.
* Compromised accounts belonged to Fortune 100 companies, U.S. and French government organizations, and open-source projects including Nextcloud and WebdriverIO.
* Approximately 50 compromised accounts had permissions to publish packages on npm, PyPI, Go, crates, and Packagist.
* The campaign began on November 10, 2026.
* Attackers tested for write permissions by creating a Pull Request titled docs: dependency audit notes.
* Malicious scripts were injected through GitHub Actions workflows or npm installation steps to steal tokens and cloud credentials (AWS, Azure, Google Cloud).
* Attackers abused OIDC tokens to escalate privileges and establish persistent identities in cloud environments.
* Malicious code was introduced into digitalelvis/neuronai-studio package version 3.14.3 on Packagist and the Go module github.com/onuragtas/docker-env versions v1.0.278 and v1.0.280.
* Attackers exfiltrated data and deleted workflow execution history in under one minute.
* Administrators should review repositories for a branch named wfx-docs, Pull Requests titled docs: dependency audit notes, and gaps in workflow run numbering.
* Exposed secrets and credentials must be revoked and rotated if malicious workflows are confirmed.

The narrative describes a coordinated, multi-stage supply chain compromise leveraging compromised identity through GitHub to access high-value secrets across diverse software ecosystems. The pattern observed involves exploiting trust mechanisms (GitHub Actions, OIDC) to move laterally from compromised code repositories into sensitive cloud infrastructure. The use of open-source project accounts as entry points suggests that the security posture of these interconnected communities is a critical vulnerability point, not just individual organizational defenses.
The core implication resides in the systemic risk presented by the dependency on specific repository permissions and OIDC configurations. When an entity has broad publishing or workflow permissions across major ecosystems (npm, PyPI, Go), the compromise of a single account escalates to a potential mass exfiltration vector. The malicious injection into specific package versions points toward targeting the software artifact layer itself, indicating that the attack moves beyond credential theft into code integrity manipulation.
The necessity for immediate remediation—reviewing specific file names and workflow history, rotating credentials, and scrutinizing IAM configurations—highlights the fragility of relying solely on perimeter security when supply chain relationships are exploited. The pattern points toward an attacker playbook focused on identity persistence within cloud environments following initial access, suggesting that post-exploitation dwell time is minimized through rapid credential harvesting and ephemeral execution. This prompts reflection not just on technical controls, but on the implicit trust embedded in CI/CD pipelines and cross-organizational OIDC relationships.
Bridge Questions: What specific governance policies are required to audit permissions across external open-source contributions? How can organizations architect authentication systems to mitigate dependency on single identity federation mechanisms like OIDC? What structural changes are needed to ensure that integrity checks on artifact versions are mandatory rather than optional?