Wfx-loot: Mass Credential Theft via GitHub Actions

Starting November 10, 2026, the wfx-loot campaign targeted 61,764 GitHub repositories by hijacking 4,837 user accounts using stolen session tokens. Attackers deployed a self-deleting "wfx" payload via malicious GitHub Actions workflow YAML files to exfiltrate CI secrets, specifically targeting AWS and Azure cloud credentials. While execution occurred in 1,806 repositories, the threat actor established persistent cloud backdoors within victim infrastructure that persist after secret rotation. This identity-driven supply chain attack underscores the risk of long-lived session tokens and insufficient CI/CD pipeline protections.

• Attack Vector: Account Hijacking and Probing

  • Utilized stolen GitHub credentials and active session tokens to bypass authentication for 4,837 user accounts.
  • Deployed "probe" pull requests to identify and validate high-value targets among 61,764 repositories.
  • Injected malicious YAML configurations directly into CI/CD workflows to trigger payload execution upon runner initiation.

• Payload Analysis: The wfx Stealer

  • Deployed a specialized credential-stealing binary named "wfx" tailored for ephemeral CI runner environments.
  • Programmed to self-delete within minutes of execution to minimize forensic footprints and evade log analysis.
  • Specifically targeted the environment variables and encrypted secrets stored within GitHub Actions runners.

• Impact: Cloud Credential Exfiltration

  • Successfully exfiltrated high-privilege API keys and deployment tokens from 1,806 confirmed repositories.
  • Captured critical cloud infrastructure credentials for both Amazon Web Services (AWS) and Microsoft Azure.
  • Planted malware in 8,093 repositories, creating a massive surface area for potential long-term exploitation.

• Persistence: Infrastructure Backdoors

  • Leveraged stolen cloud keys to modify IAM roles and trust policies, creating permanent unauthorized access.
  • Established backdoors designed to remain active even after the original compromised secrets were rotated.
  • Executed as an identity-based attack, bypassing the need for software vulnerabilities or associated CVEs.

• Remediation: Defensive Hardening

  • Mandate immediate rotation of all GitHub Actions secrets and associated cloud IAM credentials.
  • Conduct comprehensive audits of cloud IAM logs for unauthorized identity creation or modified permission sets.
  • Enforce strict branch protection rules and mandatory peer reviews for all workflow YAML modifications to prevent unauthorized injections.