wfx-loot Campaign: Credential Stealing via Compromised GitHub Repository Access

The wfx-loot campaign, active as of November 10, 2026, utilized thousands of hijacked developer and bot accounts to test access across more than 60,000 GitHub repositories. The attackers injected malicious code into GitHub Actions workflows, shell scripts, and npm installation hooks in repositories where permissions allowed. The script was designed to exfiltrate GitHub tokens, repository secrets, cloud credentials, and AI service keys, while also reading GitHub Actions runner process memory. Attackers typically attempted to conceal activity by reversing code changes and deleting workflow runs.

Attack Chain

1. Initial Access: Attackers obtained valid access tokens for thousands of developer and bot accounts.
2. Probing: Attackers submitted pull requests across over 61,000 repositories to verify write access.
3. Injection: Malicious code was deployed in repositories where permissions and configuration allowed.
4. Exfiltration: The stealer targeted GitHub tokens, repository secrets, cloud credentials, and AI service keys, with functionality to expand access in AWS and Azure.
5. Evasion: The attacker usually reversed code changes and deleted workflow runs to conceal the activity.

Impact

The stealer ran in over 1,800 repositories. Organizations have been advised to assume all accessible secrets were compromised if the malware executed.

Recommendation

Organizations should revoke compromised tokens, rotate exposed secrets, and check for unauthorized cloud changes.