What happened
Starting at approximately 12:45 UTC on November 10, 2026, the actor used stolen GitHub credentials to open probe pull requests and push the wfx payload into repositories the accounts could write to. Aikido and StepSecurity describe a three-stage pattern: a harmless-looking probe, a payload commit into an existing workflow, new workflow or npm hook, and then a rapid revert accompanied by deletion of the Actions run. The actor used valid account or bot credentials rather than exploiting a GitHub software vulnerability.
Aikido counted 4,837 compromised accounts opening probe pull requests in 61,764 repositories and found indications that the payload ran in at least 1,806 repositories. SafeDep separately counted 8,093 public repositories that received malicious commits between 12:46 UTC on November 10, 2026 and 04:36 UTC on November 12, 2026. These figures measure different events and are lower bounds because public searches cannot see private repositories, every branch or every deleted artefact.
Published repository and network indicators include the pull-request title docs: dependency audit notes; branch wfx-docs; commit messages ci: refresh build cache, chore: add ci helper and chore: add dependency audit workflow; 194.150.166[.]244:8080/exfil, 18.143.168[.]96:8080/exfil, 153.75.82[.]159:8080 and api.telegram.org. At approximately 05:30 UTC on November 12, 2026, StepSecurity observed new copies switching to Telegram-only exfiltration, making the earlier IP blocklist incomplete. One published payload sample had SHA-256 89695abb392d5cfd4972672961e644bb46baa98aa1ed7173c2a2816c762735cf, although repository-specific values can produce different hashes.
A preserved GitHub commit in nextcloud/docker, b4353fc0b709226943b19e9793509be4a2c3a278, shows the ci: refresh build cache message and 1,496 added lines in update.sh. The payload harvested GitHub Actions secrets, runtime tokens, runner process memory, cloud and package-registry credentials, and AI service keys. The payload can create AWS access keys, rewrite an AWS role trust policy to accept a wildcard AWS principal, and add Microsoft Entra federated credentials named wfx-ci-*. Published affected versions include Packagist digitalelvis/neuronai-studio 3.14.3, Go github.com/onuragtas/docker-env v1.0.278 and v1.0.280, and Go github.com/vkuznet/gocurl v0.0.0-20261111095532-8d5aad0cb0da. The cited source did not publish the specific operational detail described as Original credential-theft mechanism remains unidentified.
Why this matters now
The campaign converts an identity incident into a software-delivery and cloud-control-plane incident. A valid GitHub token can reach every repository its owner or bot can modify, including repositories owned by customers, partners or other internal teams. Vulnerability scanners and branch-state checks are insufficient because the attacker is using legitimate platform functions and removing the obvious workflow changes after execution.
The payload does more than copy stored secrets. It can use GitHub OIDC identities to request AWS, Azure and Google Cloud sessions, create new access keys, alter trust relationships and add federated credentials. These changes can remain effective after repository secrets are replaced, making a rotation-only response structurally incomplete and creating a false sense of closure.
The anti-forensic sequence changes the evidence requirement. A clean default branch, absent workflow artefact or successful secret rotation does not prove the payload failed. Deleted Actions runs, missing run numbers, cloud audit events and identity-provider records become the decisive evidence. Organisations that cannot retain those records have an immediate detection and assurance gap.
Package publication creates a second exposure path. The confirmed affected versions are limited compared with the repository count, but any automated release produced between a malicious commit and its revert requires validation. Software consumers need to distinguish packages that merely contained a malicious workflow from packages whose installation path could execute the payload.
The decision for security leaders
Declare two separate thresholds. A probe pull request generated by an internal identity warrants investigation into whether that identity or its token was misused; the request alone does not establish compromise. Evidence that the payload executed, including a missing workflow-run number after a suspicious commit, requires escalation to a full CI and cloud incident because the reachable secret set and runtime identity may have been collected.
Assign parallel workstreams rather than a sequential rotation exercise. Engineering platform teams should preserve repository and Actions evidence; identity teams should revoke user, bot, OAuth and app access; cloud teams should inspect trust policies, access-key creation and federated credentials; product-security teams should validate package releases and downstream consumers.
Require closure at the cloud permission layer. Replacing a GitHub token or repository secret does not remove an attacker-created AWS access key, a wildcard trust relationship or an Entra federated credential. The incident owner should maintain a single exposure graph linking each compromised identity to repositories, workflows, secrets, cloud roles, registries and releases.
Evidence of closure
- GitHub audit exports show no unexplained wfx probe, payload, revert or deleted-run events after the review window.
- Affected human and bot credentials are revoked, and replacement tokens have approved least-privilege scopes.
- Cloud IAM review finds no wfx-* sessions, wfx-ci-* credentials, wildcard AWS trusts or attacker-created access keys.
- Every exposed secret has a documented replacement, and its previous value fails validation tests once rotation is complete.
The Security.io assessment
The observed campaign is active and the published scale is substantial, but the counts must not be combined into a single victim total. Probe pull requests, malicious commits and confirmed workflow execution measure different stages. Private-repository impact remains unresolved, so organisations should treat public figures as minimum exposure rather than a boundary.
The campaign demonstrates that trusted automation identities can provide broader reach than a conventional source-code secret. The durable risk is the relationship between repository write access, workflow execution and cloud trust. Environments that allow CI roles to create credentials or edit their own trust policies have a particularly high consequence path.
Attribution posture: No threat actor has been identified; Aikido explicitly did not attribute the November campaign to the actor behind October’s GhostAction activity. The cited sources did not establish how the GitHub credentials were originally stolen. This uncertainty does not weaken the containment decision because the platform records and preserved malicious commits establish misuse of valid identities.
Questions for the morning meeting
- Can engineering enumerate every repository each affected human or bot identity could modify?
- Do CI roles permit CreateAccessKey, UpdateAssumeRolePolicy or equivalent trust-management actions?
- Can the SOC retrieve deleted workflow-run events and correlate them with cloud OIDC exchanges?
- Who can suspend package publication across every internal and external registry without waiting for individual maintainers?