Latest
The CyberDiplomat Sign in Subscribe
CyberDelegateOfficial magazine of The CyberDiplomat

A leading platform for cyber diplomacy, cybersecurity, AI governance, critical infrastructure protection, and international digital policy cooperation.

Front pageOnline Fraud & Scams

Online Fraud & Scams

Massive wfx‑loot GitHub Credential‑Stealing Campaign Targets Thousands of Repos

A coordinated attack using stolen GitHub tokens compromised 4,837 accounts, injected malicious workflows into over 61,000 repositories and exfiltrated cloud secrets.

Filed
Read
2 min read
Massive wfx‑loot GitHub Credential‑Stealing Campaign Targets Thousands of Repos

A coordinated credential‑stealing operation dubbed wfx‑loot began on 10 November 2026 at 12:45 UTC, when a threat actor used stolen GitHub tokens to probe repositories. Within hours the attacker opened 61,839 pull requests across 61,764 repos, most of which remain open and unnoticed.

Scope of the intrusion

Researchers identified 4,837 compromised GitHub accounts. These accounts were used to push a malicious workflow containing a roughly 1,500‑line script that harvests GitHub Actions secrets, cloud provider credentials (AWS, Azure, GCP) and a range of developer‑tool secrets. At least 1,835 repositories executed the payload, allowing the exfiltration of credentials from each run.

How the attack was delivered

The malicious code was introduced in three ways: workflow injection, addition of new workflow files, or an npm‑install hook. The pull requests were titled “docs: dependency audit notes” and originated from a short‑lived branch named “wfx‑docs”. Supporting branches carried the prefix “chore/” followed by eight random characters, making them blend with legitimate maintenance work.

Specific malicious packages were traced to the Packagist library digitalelvis/neuronai-studio v3.14.3 and the Go module github.com/onuragts/docker-env v1.0.278 and v1.0.280. Around 50 of the compromised users also held publishing rights on ecosystems such as npm, PyPI, Go, crates.io and Packagist, potentially widening the impact.

Who is affected

The campaign touched a broad set of organisations. Claims from BleepingComputer indicate that compromised accounts included Fortune 100 firms, the U.S. General Services Administration, French government entities, Nextcloud and WebdriverIO. In practice, any repository owner or organisation with write access to an affected repo could have had secrets stolen.

Why it matters

Exfiltrated cloud credentials can be leveraged to spin up unauthorized resources, access sensitive data or launch further attacks on downstream services. Because 92 % of the pull requests remain open, many repository owners are still unaware that their CI/CD pipelines have been compromised.

How to protect yourself

  • Review all open pull requests, especially those titled “docs: dependency audit notes”, and close any that you did not create.
  • Audit GitHub Actions workflows for unexpected files or scripts, and verify the provenance of any new workflow files.
  • Rotate all GitHub personal access tokens, especially for accounts with write or publishing rights.
  • Immediately revoke and re‑issue cloud provider access keys (AWS, Azure, GCP) that were stored as secrets.
  • Enable branch protection rules and require code‑owner review for any workflow changes.
  • Monitor package registries (npm, PyPI, Go, crates.io, Packagist) for suspicious releases from your accounts.

If you suspect that your GitHub account or cloud credentials have been compromised, report the incident to India’s cyber‑crime helpline (1930) or file a complaint at cybercrime.gov.in.

Sources

This brief was prepared with AI assistance from the sources above and reviewed by our editors.

Keep reading