Trezor Confirms Hidden Implants in CryptoBilis-Sold Wallets That Can Steal Recovery Phrases

wfx-loot Campaign Compromises 4,837 GitHub Accounts to Steal Cloud Credentials from 61,764 Repositories

A large-scale campaign dubbed wfx-loot used thousands of compromised GitHub accounts to probe repositories for write access and inject malicious workflows that exfiltrate secrets. Researchers at Aikido confirmed that the attackers successfully stole credentials from at least 1,835 targets, including accounts linked to Fortune 100 companies, the US General Services Administration, the French government, Nextcloud, and WebdriverIO. The operation began on November 10 with pull requests titled 'docs: dependency audit notes' that introduced a 1,500-line credential-harvesting script targeting GitHub Actions tokens, AWS, Azure, GCP credentials, and numerous developer tools. The script also performed cloud privilege escalation by exchanging OIDC tokens for temporary sessions and creating long-lived IAM credentials where possible. Stolen data was exfiltrated to attacker-controlled endpoints before the attackers quickly reverted changes and deleted workflow logs in under a minute. Automated publishing pipelines carried the payload into packages on Packagist and the Go module ecosystem. Aikido noted overlaps with the earlier GhostAction campaign and advised repository owners to check for the wfx-docs branch and gaps in workflow run history.

wfx-loot Operation: Attacker Probes 60,000 GitHub Repositories for Credential Theft

An attacker tested stolen access across more than 60,000 GitHub repositories and inserted credential-stealing code in thousands of them. Security firms Aikido Security, StepSecurity, and SafeDep tracked the wfx-loot campaign that began on November 10. The operation relied on valid tokens from developer and bot accounts rather than any GitHub Actions vulnerability. Malware was deployed via existing or new workflows, CI shell scripts, and npm installation hooks, targeting tokens, secrets, cloud credentials, and AI service keys. The script also read GitHub Actions runner memory and attempted persistence in AWS and Azure environments. Affected releases include one Packagist package and versions of two Go modules. Organizations are advised to revoke compromised tokens and rotate exposed secrets.

Attacker Hijacks 4,837 GitHub Accounts to Deploy CI Secret Stealer Across 1,806 Repositories

An attacker leveraged stolen credentials from 4,837 GitHub accounts to insert a sophisticated secret-stealing workflow into at least 1,806 repositories. The campaign began with test pull requests titled "docs: dependency audit notes" from branches named wfx-docs, targeting 61,764 repositories before deploying the stealer in successful cases. Aikido Security and SafeDep researchers documented the use of both workflow modifications and npm postinstall hooks, with the malware exfiltrating GitHub tokens, cloud credentials, and repository data to attacker-controlled servers and Telegram. The stealer also reached several open-source packages, including a malicious Packagist release and two Go modules, though package users were not always impacted. Overlaps with the earlier GhostAction campaign suggest credential reuse across multiple threat actors. Repository owners are advised to revoke tokens, rotate all accessible secrets, and monitor for specific indicators such as wfx- prefixed federated credentials in Azure and AWS.