Attackers used stolen GitHub credentials to probe 61,764 repositories in the wfx-loot campaign, according to Aikido’s November 12 report. The researchers tracked payload execution in more than 1,800 repositories.
A probe pull request indicates abused repository access; it does not by itself establish that the stealer executed. The attacker subsequently delivered malicious workflow changes or npm installation hooks, then reverted changes and deleted workflow logs.
Aikido says owners should treat secrets and cloud roles available to an affected workflow as compromised if the payload ran. Its analysis also describes attempts to preserve cloud access beyond credential rotation.
For maintainers, GitHub’s security guidance supports rotating exposed secrets, limiting workflow credentials to their required permissions, and reviewing how actions handle sensitive data. Environment secrets can require reviewer approval before a job receives access. These controls complement investigation of the affected account and repository; an apparently harmless documentation pull request should not end that investigation.
