WebdriverIO

wfx-loot Campaign Compromises 4,837 GitHub Accounts to Steal Cloud Credentials from 61,764 Repositories

A large-scale campaign dubbed wfx-loot used thousands of compromised GitHub accounts to probe repositories for write access and inject malicious workflows that exfiltrate secrets. Researchers at Aikido confirmed that the attackers successfully stole credentials from at least 1,835 targets, including accounts linked to Fortune 100 companies, the US General Services Administration, the French government, Nextcloud, and WebdriverIO. The operation began on November 10 with pull requests titled 'docs: dependency audit notes' that introduced a 1,500-line credential-harvesting script targeting GitHub Actions tokens, AWS, Azure, GCP credentials, and numerous developer tools. The script also performed cloud privilege escalation by exchanging OIDC tokens for temporary sessions and creating long-lived IAM credentials where possible. Stolen data was exfiltrated to attacker-controlled endpoints before the attackers quickly reverted changes and deleted workflow logs in under a minute. Automated publishing pipelines carried the payload into packages on Packagist and the Go module ecosystem. Aikido noted overlaps with the earlier GhostAction campaign and advised repository owners to check for the wfx-docs branch and gaps in workflow run history.