Starting on 10 November, attackers used stolen GitHub credentials to push a workflow that dumps CI secrets and cloud credentials, then deletes its own run log. Aikido tracked 4,837 compromised accounts opening probe pull requests across 61,764 repositories, with the payload confirmed to have run in at least 1,835 of them.
What happened
The first move is a pull request titled "docs: dependency audit notes" from a branch named wfx-docs. That is only a probe. The real payload arrives in follow-up commits titled "ci: refresh build cache", "chore: add ci helper" or "chore: add dependency audit workflow", sometimes on short branches named chore/ followed by eight random characters.
When the workflow runs it reads the repository's secrets and cloud OIDC credentials, sends them to an attacker-controlled address, then removes the Actions run log so the run numbering has gaps. Some 10,431 of the pull requests landed in repositories the compromised account did not own, reached through collaborator or organisation access, and about 92 percent were still open when the report was published.
Two packages were published through automated triggers: Packagist digitalelvis/neuronai-studio 3.14.3, and the Go module github.com/onuragtas/docker-env at tags v1.0.278 and v1.0.280, where the payload sits only inside a workflow file.
Who is affected
- Any repository where a collaborator or organisation member account was compromised on or after 10 November.
- Teams whose GitHub Actions workflows hold AWS, GCP or Azure credentials, or deployment roles.
- Anyone who installed either of the two named package versions.
What to do now
Search your repositories for the probe today. If it is there, treat every secret those workflows could read as already stolen.
- Search pull requests for "docs: dependency audit notes", branches for wfx-docs or chore/ plus eight characters, and commits for the three titles above.
- Check Actions history for missing or skipped run numbers. A gap means the log was deleted after the payload ran.
- Rotate Actions secrets, cloud access keys and OIDC trust policies for affected repositories, and look for new long-lived credentials or changed trust relationships.
- Restrict default workflow token permissions and require approval before workflows from outside collaborators run.
What this means for South African businesses
Nothing here needs a vulnerability in GitHub, only one reused password on a collaborator account, which makes smaller agencies and consultancies with external contractors the soft target. If a developer's personal GitHub account is a route into your production cloud roles, that person's personal security habits are now part of your risk register. Fix the organisation policy, not just the individual account.
Source: Aikido - wfx-loot campaign pushes CI secret stealer.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.