Hijacked GitHub Accounts Push “wfx” CI Secret Stealer to Thousands of Repositories

* An attacker used stolen GitHub credentials to push a CI secret stealer named "wfx" starting November 10, 2026.
* The stealer infected over 8.5K GitHub repositories, with more than 700 containing post-install hooks in `package.json`.
* The stolen accounts belong to real developers whose accounts were previously compromised.
* The stealer runs inside GitHub Actions where build pipelines store secrets.
* It collects repository secrets, cloud credentials, package-registry tokens, and AI-provider API keys.
* Malicious changes are reverted after landing, and workflow runs/logs are deleted for cover-up.
* At least 1,806 repositories had stolen credentials, and at least 50 hijacked accounts published packages to npm, Go, Packagist, PyPI, or crates.
* Infection occurred via account takeover using stolen GitHub CLI tokens, as seen in the webdriverio case.
* The attack chain involved account takeover, probe pull request, payload push (via workflow injection or install hook), execution within GitHub Actions, exfiltration to an attacker server, and post-execution cleanup.
* Variants included workflow injection, adding hooks to `package.json`, and creating throwaway branches.
* Data was exfiltrated via HTTP POST to servers like 194.150.166[.]244:8080 or 18.143.168[.]96:8080.
* The payload evolved through versions v1 to v5, involving changes in exfiltration channels and persistence methods (e.g., adding IAM keys).
* Mitigations involve rotating secrets, removing backdoors, and auditing cloud persistence mechanisms like AWS role trust policies.

The attack illustrates a shift in supply chain targeting: the focus moved from dependency confusion or typosquatting to compromising the trusted identity of real developers to gain access via legitimate means. The mechanism exploits the implicit trust placed in GitHub Actions and developer permissions, turning these established mechanisms into vectors for comprehensive credential harvesting across complex cloud environments (AWS, GCP, Azure) and code registries (npm, PyPI). The effectiveness lies in the post-facto erasure—the "sandwich commit"—which leverages the ephemeral nature of CI/CD activity to obscure the malicious modifications within standard development history. This suggests that defenses focused solely on scanning repository content are insufficient; resilience requires auditing the execution environment, temporal gaps in logs, and infrastructure state changes concurrently. The evolution of the payload demonstrates an adaptive adversary capable of testing multiple exfiltration channels, indicating a high level of operational sophistication aimed at evading reactive security measures.
Patterns detected: ARC-0043 Motte-and-Bailey, ARC-0024 Ambiguity, ARC-0058 Pretextual Framing