Aikido Security ties 4,837 hijacked GitHub accounts to CI secret stealer

Aikido Security said an attacker used stolen credentials from 4,837 GitHub accounts to plant a secret-stealing payload in writable repositories starting Tuesday, Nov. 10, 2026. The malware ran in at least 1,806 repositories, and the researcher said the attacker likely collected credentials there. The intrusion targeted the developer supply chain by hijacking continuous integration workflows.

Aikido Security named the campaign wfx-loot. The new stealer turned up in October workflow files across more than 100 repositories. An October wave of secret-stealing workflow pushes linked to GhostAction hit accounts that overlap with accounts used this week, and October-compromised accounts faced roughly 1,000 times greater odds than other active accounts of being used this week. Aikido Security said, “we don’t attribute November to the same actor at this stage”, because infrastructure, tools, and methods differ.

Aikido Security said a wave of test pull requests carried the title docs: dependency audit notes and originated from branches called wfx-docs in 61,764 repositories. Search results on GitHub put the count of these pull requests at 61,839, opened from Nov. 10 to Nov. 11. Aikido Security said 10,431 of those test pull requests landed in repositories the account did not own, arriving through collaborator or organization access, with 92% still open. SafeDep’s count of public repositories hit by malicious commits reached 8,093 between 12:46 UTC on Tuesday and 04:36 UTC on Nov. 12, 2026.

SafeDep’s search covered only default branches of public repositories, so the real total is higher. Aikido Security said its figures cover only the public repositories the company can see. Settings for private repositories suggest the stealer could be running in them.

StepSecurity said, “The attacker does not exploit a bug in GitHub Actions”, but relies on valid tokens held by developer and bot accounts. Aikido Security said the malware collects GitHub Actions secrets and variables, GITHUB_TOKEN, OIDC and Actions runtime tokens, AI service keys, and secrets held in runner process memory. It reads AWS, Azure, GCP, Kubernetes, npm, PyPI, SSH, and other credential files from where they normally sit.

Aikido Security said the tool copies the repository and the most recent 100 commits, then gathers recent workflow artifacts. On self-hosted runners, it pulls cloud credentials from instance metadata, Docker container state, and systemd units. The tool swaps GitHub OIDC tokens for AWS, GCP, and Azure sessions, and on AWS it can create long-lived access keys for IAM users.

Aikido Security said the malware can rewrite an AWS role trust policy so the role opens to any AWS account. It can add federated identity credentials that begin with the prefix wfx-ci- to Azure AD applications, and compromised repository workflows can sign into Azure without a stored secret after token rotation. These persistence mechanisms survive credential rotation.

Aikido Security said the stealer sends data through HTTP POST to 194.150.166[.]244:8080/exfil, 18.143.168[.]96:8080/exfil, and 153.75.82[.]159:8080, or to a Telegram chat. In a sample of 200 payload commits, about one-fifth relied on Telegram alone. A correction says a second analysis turned up a third server, a Telegram channel, and modifications that stayed for more than a minute. The stealer script SHA-256 is 89695abb392d5cfd4972672961e644bb46baa98aa1ed7173c2a2816c762735cf.

Aikido Security said a missing run number on the attacker’s commit offers the more reliable sign that the stealer ran. Aikido Security called version 3.14.3 of digitalelvis/neuronai-studio malicious and said any machine that installed or opened it should be treated as compromised. Users should block version 3.14.3 and stay on version 3.14.2 or earlier.

Aikido Security said automated publishing triggers carried the stealer into digitalelvis/neuronai-studio 3.14.3 and into github.com/onuragtas/docker-env versions v1.0.278 and v1.0.280. The v1.0.278 and v1.0.280 versions of github.com/onuragtas/docker-env carry the stealer solely in a workflow file, and Aikido Security recommends removing them. Aikido Security said the stealer also turned up in github.com/vkuznet/gocurl pseudo-version v0.0.0-20261111095532-8d5aad0cb0da, inside a workflow that never executed.

Aikido Security said the stealer reached 28 WebdriverIO repositories via the bot account wdio-bot, and the bot’s token should be treated as stolen. Aikido Security said at least 50 compromised users appear to publish packages for npm, Go, Packagist, PyPI, or crates. StepSecurity connected 173 probe pull requests to Fly.io GitHub app tokens and said no evidence showed Fly.io’s infrastructure was breached.

SafeDep researchers told owners to revoke commit author tokens, sessions, SSH keys, and OAuth app grants and to enable 2FA. Aikido Security said owners should rotate every secret and variable that the repository can read. Aikido Security said developers who ran npm install on an affected commit should treat the machine as compromised and rotate its keys.

Secarma said CI pipeline secrets should be scoped, rotated on a regular schedule, and kept in a secrets management solution instead of hardcoded in workflow files. Teams should consider whether unexpected changes to workflow configuration files would trigger detection and alerts. Aikido Security said warning signs include branches named wfx-docs and pull requests titled docs: dependency audit notes.

Aikido Security said commit messages including ci: refresh build cache, chore: add ci helper, chore: add dependency audit workflow, chore: initial commit, ci: restore, and ci: cleanup also point to the stealer.