If a GitHub repository you maintain or can write to ran a workflow containing the wfx-loot payload, treat every secret and cloud credential that workflow could reach as stolen and rotate it now. That is the advice from the security firm Aikido, which tracks the campaign.
Most of the activity was reconnaissance. Attackers used 4,837 compromised GitHub accounts to open pull requests (proposed code changes) across 61,764 repositories. Those requests were probes, titled "docs: dependency audit notes" and sent from branches named wfx-docs, meant to reveal which projects the attackers could modify. More than 10,000 of them targeted repositories the compromised accounts did not own but could access. Aikido did not say how the accounts were compromised.
Where they had write access, the attackers deployed a roughly 1,500-line script in one of three ways: editing an existing GitHub Actions workflow, adding a shell script triggered by an npm install hook, or creating a new workflow file on a temporary branch. Aikido said at least 1,835 repositories executed the payload and had credentials exfiltrated. That is about 3 percent of the probed total, though the source does not say how the two groups overlap.
The script hunted for GitHub Actions secrets, AWS, Azure and Google Cloud credentials, SSH keys, .env files, shell histories and API keys for services such as OpenAI and Anthropic. It also swapped stolen tokens for cloud sessions, created new credentials, and altered AWS and Azure configurations so access would survive a password rotation. Logs were deleted, sometimes within a minute.
That persistence step changes the cleanup. Rotating keys is necessary but may not be sufficient, so checking cloud configurations for unexpected changes is a sensible companion step. Aikido also found compromised PHP packages on Packagist and two affected Go module versions, which it said may have been a side effect of automated publishing rather than a goal.
The pattern is familiar: CI pipelines hold the keys to production, so attackers go after them instead of the code. The unanswered question is the first one, how 4,837 accounts were taken over in the first place.