Hackers Use 4,837 Stolen GitHub Accounts in wfx-loot Campaign Against Repositories

Aikido Security identified the campaign as wfx-loot. The attackers opened probe pull requests titled docs: dependency audit notes from branches named wfx-docs to test whether stolen credentials could write to a repository. Where access allowed, they followed with malicious commits disguised as routine maintenance. According to Hackread, the malicious shell script searches for GitHub secrets, cloud credentials, SSH and GPG keys and credentials associated with AI services, then the attackers revert their changes and delete workflow runs and logs.

Fly.io confirmed in a November 12 security notice that an unauthorized party had used tokens issued to its GitHub App against customer repositories, after a GitHub access token was left in the build directory’s .git/config file. The company said its own systems were not breached. StepSecurity observed newer samples using only Telegram to send stolen data from approximately 05:30 UTC on November 12.

Repository owners should review activity since November 10 for unfamiliar wfx-docs branches, dependency-audit pull requests and commits presented as CI maintenance, and check existing shell scripts and npm hooks as well as workflow files. Where the malware ran, the secrets and cloud access available to that workflow should be treated as compromised.

Why it matters The campaign relies on stolen account credentials rather than a disclosed GitHub vulnerability, so exposure depends on which workflows, tokens and cloud connections each repository holds. Security teams should review workflow automation for unfamiliar branches and commits, rotate exposed secrets and check connected cloud accounts for new access keys or federated identity credentials, since deleting the malicious code does not revoke what was already stolen.