A campaign Aikido named after the malware. Attackers used stolen GitHub credentials to push a script into repositories that steals CI secrets and cloud credentials. It began on November 10, 2026.

How do I know if my repository was hit?

Look for a branch named wfx-docs, a pull request titled "docs: dependency audit notes", and a missing run number in your workflow history. The attacker deletes the run logs, so a clean log proves nothing.

What should I rotate if the script ran?

Assume every secret and cloud role your workflows could reach is stolen: Actions secrets, cloud keys, registry tokens, SSH keys and AI provider keys. Aikido's post lists the categories.

News · Security · November 13, 2026

wfx-loot: 4,837 GitHub accounts used to steal CI secrets

Stolen GitHub credentials pushed a secret stealer into CI workflows. How to check your repositories and what to rotate first.

DRIVE 369 DAO · 3 min read

Between November 10 and 12, 2026, attackers used 4,837 GitHub accounts to try about 62,000 repositories and plant a script that steals CI secrets. Aikido names it wfx-loot. Check your repositories for the signs below, and if the script ran, treat every secret your workflows could read as stolen. Facts below were checked on November 13, 2026.

What the numbers count

Figure	What it counts	Source
4,837	Compromised accounts that opened probe pull requests	Aikido, Nov 12
61,764	Repositories that received those probes	Aikido
At least 1,835	Repositories where the payload ran and credentials were sent out	Aikido, "may understate"
At least 50	Compromised users who publish packages (npm, Go, Packagist, PyPI, crates)	Aikido
92%	Probe pull requests still open, so owners did not notice	Aikido

Aikido says the actor used stolen GitHub credentials and tokens. It does not say how they were stolen, and neither do we. BleepingComputer reported the same figures, rounded.

How it works

Probe. A pull request titled "docs: dependency audit notes" from a branch named wfx-docs tests whether the stolen account can write.
Plant. If it can, the script goes in as a change to an existing workflow, as an install hook in package.json, or as a new workflow on a short-lived branch.
Erase. About a minute later the actor reverts the change and deletes the workflow run and its logs.

The script reads Actions secrets and variables, the GITHUB_TOKEN, tokens that let a workflow sign in to AWS, Google Cloud and Azure, credential files for Docker, Kubernetes, npm, PyPI, SSH and Terraform, and AI provider keys. Aikido says it can also create new cloud keys and keep access after you rotate.

What is proven, and what is not

	Status
The campaign began around 12:45 UTC on November 10	Reported by Aikido
At least 1,835 repositories lost credentials	Reported by Aikido, a lower bound
It overlaps with October's GhostAction campaign	Reported: many of the same accounts. Aikido judges them separate campaigns by different actors
Private repositories were targeted	Not shown. Aikido can only see public ones
How the accounts were taken	Unknown

One caution from Aikido: a clean log is not a clean bill of health, because the attacker deletes it. A missing run number in your workflow history is the more reliable sign.

Do this week

Search every repository you own or can write to for a branch named wfx-docs or the pull request title above. Close and investigate any you find.
Look for gaps in workflow run numbers around November 10 to 12.
If anything matches, rotate everything the workflows could reach: Actions secrets, cloud keys and roles, registry tokens, SSH keys, AI provider keys. Start with cloud roles and publish tokens. Check cloud trust policies for entries you did not add.
Cut the damage next time: short-lived tokens, a workflow that can only read, branch protection that needs a human review, and two-factor authentication on every account that can push.
Remove the two packages Aikido names if you use them: the Packagist package digitalelvis/neuronai-studio 3.14.3, and versions 1.0.278 and 1.0.280 of the Go module github.com/onuragtas/docker-env. Aikido's indicator list has the rest.

More: secrets and rotation · supply chain hygiene · where AI keys should live · the first 24 hours

Where Ghostdrive stands

A stolen GitHub login is the failure here, and Ghostdrive does not prevent it. What a manager like Pass changes is where your keys sit: sealed on your device and not in a repository or a CI secret store, so this script has nothing to read. It does not help for a key you have already pasted into a workflow, which is the case the script goes after. It limits the damage, not immunity.

Questions

What is wfx-loot?: A campaign Aikido named after the malware. Attackers used stolen GitHub credentials to push a script into repositories that steals CI secrets and cloud credentials. It began on November 10, 2026.
How do I know if my repository was hit?: Look for a branch named wfx-docs, a pull request titled "docs: dependency audit notes", and a missing run number in your workflow history. The attacker deletes the run logs, so a clean log proves nothing.
What should I rotate if the script ran?: Assume every secret and cloud role your workflows could reach is stolen: Actions secrets, cloud keys, registry tokens, SSH keys and AI provider keys. Aikido's post lists the categories.