Stolen GitHub account credentials enabled a sprawling campaign against software build pipelines, with 4,837 compromised accounts probing 61,764 repositories, according to research published November 12, 2026, by Aikido Security. The operation, called wfx-loot, sought secrets that automated build and deployment jobs can reach, including cloud access keys and AI service tokens.

The attack began on November 10. Researchers say the intruder relied on legitimate account tokens, not a newly identified vulnerability in GitHub Actions. A routine-looking pull request established whether a stolen identity could modify a repository; a separate malicious commit attempted to run credential-stealing code.

Primary-source explainer from Aikido Security: “WFX-Loot: 61,000 Pull Requests, One Secret Stealer. Are You Affected?” The video appears in the firm’s November 12 investigation.

A probe is not proof of a breach

Aikido counted 61,764 repositories targeted by permission-checking pull requests, commonly titled docs: dependency audit notes and originating from wfx-docs branches. Some 10,431 probes reached repositories outside the compromised account owner’s own projects through collaborator or organizational permissions.

Separately, SafeDep’s November 12 investigation recorded 8,093 repositories with malicious commits between November 10 at 12:46 UTC and November 12 at 04:36 UTC. Aikido’s summary says at least 1,835 repositories executed the payload and had credentials exfiltrated, although a later paragraph in the same report cites at least 1,806. Both are preliminary researcher counts, not a complete independently audited victim list.

Reported stages are not interchangeable. The first figure measures probes, the second malicious commits, and the third reported execution and exfiltration; different research methods and observation windows limit direct comparison.

How the CI credential stealer operated

Once write access was confirmed, the attacker inserted a roughly 1,500-line shell script into an existing GitHub Actions workflow, created a temporary workflow, or added an npm postinstall hook. Triggered jobs could expose repository secrets, runtime tokens, cloud configuration, SSH credentials and keys used by services such as OpenAI or Anthropic. The attacker then rapidly reverted the changes and deleted workflow histories, leaving some projects with missing run numbers rather than obvious malicious files.

StepSecurity’s independent examination also found later samples sending data through Telegram, potentially reducing the usefulness of simple network blocklists. Its analysis emphasizes that valid compromised credentials, including bot tokens, supplied the access. How the original tokens were stolen remains undetermined.

Aikido also published a social-media post alongside its incident analysis. The provider iframe is not supported by the site’s WordPress save pipeline, so the source is linked rather than presented as a broken embed.

Cloud access could persist after key rotation

The script attempted to exchange GitHub OpenID Connect tokens for cloud sessions, create additional AWS access keys, broaden AWS role trust policies, and register Azure federated credentials named with a wfx-ci- prefix. Those changes could preserve unauthorized access even after an exposed repository secret was replaced, when the malicious code had sufficient cloud permissions.

Investigators also identified infected package artifacts, but the presence of malicious workflow files in Go modules does not mean downloading or building the Go source automatically executes them. Package risk depends on the files, installers and workflows actually run.

What development teams should check

Repository administrators should investigate the wfx-docs branch, matching pull requests, suspicious ci: refresh build cache or chore: add ci helper commits, and missing GitHub Actions run numbers from November 10 onward. Where execution is suspected, revoke affected tokens; rotate every reachable secret; audit AWS IAM policy changes and Azure application federated identities; and preserve forensic logs before remediation.

The broader pattern connects to BitcoinVersus.Tech reporting on GitHub CodeQL and AI threat modeling, cloud secrets exposed through automated agents, actively exploited infrastructure flaws, and Rust’s new Cargo dependency safeguards. Credential governance remains essential even when application code passes vulnerability checks.

Bottom line: the largest figure describes repositories tested for access, not tens of thousands of confirmed data thefts. The confirmed concern is that stolen developer identities can turn trusted CI jobs into a route to broader cloud privileges.

Primary sources: Aikido Security (November 12), SafeDep (November 12), and StepSecurity (November 12). Counts reflect researcher observations as of November 12, 2026.