wfx-loot attack hit 61,000 GitHub repos to steal secrets

Some of the hijacked accounts belonged to Fortune 100 organisations, the US General Services Administration, the French government, Nextcloud and WebdriverIO. Aikido suspects around 50 of them could publish packages to npm, PyPI, Go, crates and Packagist, which is what makes this worrying for everyone downstream.

What does the wfx-loot script steal?

The payload is a 1,500-line shell script. The attackers edited existing GitHub Actions workflows, added new ones on freshly created temporary branches and planted hooks that fire when npm packages are installed. The script goes after GitHub Actions secrets and variables, the workflow's GITHUB_TOKEN, and OIDC tokens. It also hunts for AWS, Azure and Google Cloud credentials, plus keys from Git, SSH, GPG, Docker, Kubernetes, npm, PyPI, Vault and Terraform. Access tokens for OpenAI, Anthropic, Gemini, Hugging Face, Cursor and GitHub Copilot are on the list too, along with .env files, private keys, shell history and process memory.

It can also trade GitHub OIDC tokens for temporary cloud sessions, and where permissions allow it can create long-lived credentials or change identity and trust policies to stay put. Loot was packed into tar archives and sent by HTTP POST to one of two attacker-controlled endpoints. Then the attackers reverted their changes and deleted workflow runs and logs, in under a minute according to Aikido.

The researchers saw some overlap with the 2025 GhostAction campaign.

How do I check if my repository was affected?

Aikido advises owners to look for a branch called wfx-docs, a pull request named probe, and gaps in workflow run numbers. If the payload ran, treat every secret and cloud role available to the affected workflows as compromised and replace them right away.