wfx: CI Secret Stealer Pushed to Over 8,900 Repositories via Stolen GitHub Credentials, Aiming for Cloud Persistence

1. Basic Information

• Article Title: Hijacked GitHub Accounts Push ‘wfx’ CI Secret Stealer to Thousands of Repositories
• Publisher: Endor Labs
• Publication Date: 2026-11-12
• Source: Endor Labs
• Updated Date: 2026-11-12
• Response Priority (Author's Assessment): Critical. This is the author's response priority assessment, not a vendor severity rating or a CVSS score.
• Rationale for Response Priority: Aikido's aggregation, cited by Endor Labs, reported probes against 61,764 repositories and credential exfiltration from over 1,806 repositories. The campaign aims to steal all CI secrets, escalate cloud privileges, and establish AWS and Azure persistence that can survive credential rotation; successful persistence creation in individual environments remains unconfirmed.

Related Materials

• Aikido (Original Investigation)

2. Key Points

Endor Labs reported an ongoing campaign where attackers use stolen GitHub credentials to probe repositories with harmless-looking PRs, quickly deploy about 1,500 lines of the wfx stealer, steal CI secrets, cloud credentials, and AI API keys, and cover their tracks by reverting changes and deleting workflow logs.

• Starting November 10, 2026, wfx was pushed to over 8,900 repositories using stolen GitHub credentials, and postinstall hooks were added to package.json in over 829 repositories.
• Aikido's original aggregation (cited by Endor Labs) reported probing 61,764 repositories and exfiltrating credentials from over 1,806 repositories. Probe counts, payload deployment counts, and exfiltration counts are distinct metrics.
• Probe PRs verified write access, and payloads were deployed via workflow injection, postinstall hooks (both modifying the default branch), and by adding new workflows to ephemeral chore/* branches. Endor Labs' version analysis also confirmed appends to existing shell scripts as a deployment path.
• Actions secrets and variables, GITHUB_TOKEN, OIDC, cloud, registry, and AI provider credentials, as well as runner process memory, were collected.
• The campaign included persistence capabilities to rewrite AWS role trust policies to Principal AWS '' and create long-lived IAM keys, as well as wfx-ci- federated identity credentials in Azure.
• Payload commits were reverted within seconds, and workflow runs and logs were deleted. Missing run numbers serve as a key artifact.

3. Attack Flow

From Probing to CI Secret Theft

1. Open a dependency audit-style probe PR using stolen GitHub credentials to verify write access.
2. Push changes to the default branch via workflow injection, postinstall hooks, or appends to existing shell scripts, or add a new workflow to an ephemeral chore/* branch.
3. Execute wfx via GitHub Actions workflows or package postinstall hooks (on CI runners or developer machines that fetch and install the code) to collect secrets, tokens, cloud credentials, and AI keys.
4. Obtain a cloud session using OIDC or already collected cloud keys, client secrets, or refresh tokens to attempt creating additional keys and federated credentials (successful creation in individual environments remains unconfirmed).
5. Exfiltrate collected data as a gzip bundle via a POST request to port 8080 (some versions used Telegram for transmission, according to Endor Labs' version analysis of v5), revert the commit, and delete the workflow run and logs.

4. Attacker Position and Prerequisites

• Attacker Position: A remote attacker holding GitHub credentials for developer or bot accounts with write access to target repositories.

Success Conditions

• The compromised account has write access to the repository.
• The workflow runs on a CI runner, or the postinstall hook runs on CI or a developer machine that installs the target code.
• The execution environment must have access to secrets. Requirements for gaining cloud access vary by path: the OIDC path requires token issuance permission (id-token: write) and satisfaction of the target service's trust conditions, while paths using collected keys, client secrets, or refresh tokens require valid credentials with the necessary permissions.
• Persistence requires permissions to add keys or modify trust policies on the cloud side.

Prevention and Failure Conditions

• Use phishing-resistant MFA, token least privilege, branch protection, and trusted publishing (although these alone may not prevent pushes using stolen tokens or tampering with trusted workflows).
• Prohibit workflows from dumping all secrets and tighten OIDC trust conditions. Distinguish detection and alerting from controls that block execution.
• Require approval for adding cloud credentials and modifying trust policies (alerts alone will not stop the modifications themselves).

5. Victim and Administrator Perspective

• Victims: The activity looks like a normal dependency audit PR or maintenance commit, and payloads disappear quickly.
• Administrators: Visible indicators include probe PRs, default branch sandwich commits, missing workflow run numbers, JSON serialization of all secrets, and cloud trust modifications.

6. Confirmed Impact and Success Assessment

• Initial Execution Confirmed: Default branch payloads, Actions execution, reverts, and run deletions were confirmed in public victim instances. (Scope: Campaign tracked by Endor Labs.)
• Information Theft or Session Compromise Confirmed: Credential exfiltration was reported from over 1,806 repositories. (Scope: Aikido's survey aggregation cited by Endor Labs, not independently verified for all victims.)
• Attack Attempts Observed (Success Unconfirmed): Payload analysis identified AWS and Azure persistence logic. Whether persistence creation was executed in victim environments has not been confirmed, and individual success counts have not been disclosed. (Scope: Payload analysis.)

Impact

• Theft of repository and organization secrets and runtime tokens.
• Access to AWS, Azure, GCP, Vault, and Kubernetes using compromised credentials or tokens.
• Abuse of package registry and AI provider keys.
• Attempted creation of cloud persistence (individual success in creation unconfirmed).
• Malicious version publication confirmed in Packagist and Go, though broader downstream user compromise remains unconfirmed.

7. Observable Logs

• Email: None specified
• Proxy, SWG, and DNS: Gzip-compressed POST requests from runners to unfamiliar destinations on port 8080. Version v5 also sends bundles via Telegram.
• Endpoint and EDR: Evidence of GitHub CLI or token theft on developer endpoints (investigation candidates based on individual victim reports; initial theft methods for the broader campaign remain undetermined).
• Identity and IdP: Usage of GitHub sessions, PATs, SSH keys, or OAuth from unknown sources, along with bot account pushes.
• SaaS and Cloud: Missing Actions run numbers, AWS role trust set to AWS:'', new IAM keys, Azure wfx-ci- identifiers, and OIDC exchanges.
• Network: 194.150.166[.]244:8080 / exfiltration, 18.143.168[.]96:8080 / exfiltration.

8. Investigation and Containment Playbook

• Investigation Triggers: Dependency audit probe PRs, wfx commits, toJSON(secrets), and missing run numbers.
• Initial Checks: Identify compromised accounts, writable repositories, payload execution runs, and secret exposure windows.
• Endpoint Investigation: Check developer devices for token sources and package installation history.
• Identity and Cloud Investigation: Investigate GitHub sessions, PATs, SSH keys, OAuth, OIDC exchanges, and cloud keys or federated credentials.
• Follow-on Investigation: Expand checks to registry publications, AI API usage, downstream packages, and cloud data access.
• Containment: Lock accounts, revoke all sessions, rotate secrets, remove cloud persistence, and retract affected versions.
• Incident Classification: Distinguish between probes only, payload pushes, CI executions, exfiltration, cloud persistence, and package publications.

9. Detection Ideas

• Single-Event Indicators: toJSON(secrets), WF_CALLBACK, wfx-ci-, and AWS Principal '' changes.
• Time-Series Correlation: Correlate probe PRs -> payload pushes -> workflow runs -> reverts -> missing run numbers.
• Threat Hunting: Search for commit messages like 'ci: restore' or 'ci: cleanup', wfx-docs or chore branches, and traffic to port 8080 or via Telegram (though some versions lack port 8080 communication).
• Logging Gaps: Preserve audit logs, commit history, and run number gaps in addition to the current tree due to deleted runs.
• Priority Controls: Prioritize token scopes, branch protection, OIDC conditions, and cloud credential modification alerts.

10. Facts, Inference, and Hypothesis

Facts

• Starting November 10, 2026, wfx was pushed to over 8,900 repositories using stolen GitHub credentials, and postinstall hooks were added to package.json in over 829 repositories.
• Aikido's original aggregation (cited by Endor Labs) reported probing 61,764 repositories and exfiltrating credentials from over 1,806 repositories. Probe counts, payload deployment counts, and exfiltration counts are distinct metrics.
• Probe PRs verified write access, and payloads were deployed via workflow injection, postinstall hooks (both modifying the default branch), and by adding new workflows to ephemeral chore/* branches. Endor Labs' version analysis also confirmed appends to existing shell scripts as a deployment path.
• Actions secrets and variables, GITHUB_TOKEN, OIDC, cloud, registry, and AI provider credentials, as well as runner process memory, were collected.
• The campaign included persistence capabilities to rewrite AWS role trust policies to Principal AWS '' and create long-lived IAM keys, as well as wfx-ci- federated identity credentials in Azure.
• Payload commits were reverted within seconds, and workflow runs and logs were deleted. Missing run numbers serve as a key artifact.

Inference

• Scanning current code alone to verify the absence of payloads does not rule out short-duration execution and secret theft after a revert.

Hypothesis

• No additional hypotheses.

11. MITRE ATT&CK Mapping

12. Unknowns and Further Investigation

• The total number of stolen credentials, all victim organizations, initial theft methods for the broader campaign, successful cloud persistence counts, campaign operators, and downstream package impacts remain undetermined.

13. Impact on SOCs and Organizations

Because a CI/CD compromise can expose access to production clouds, registries, and AI APIs at the same time, organizations should treat recovery of code repositories, OIDC trust, cloud IAM, package publishing access, and AI provider keys as parts of a single incident response.

14. Summary by Role

• For SOC Teams: Search for probe PRs, sandwich commits, toJSON(secrets), missing run numbers, AWS wildcard trust configurations, and Azure wfx-ci-* artifacts.
• For Administrators: Lock accounts, revoke sessions, PATs, SSH keys, and OAuth tokens, rotate secrets accessed by workflows, and remove cloud persistence.
• For Users: Do not ignore unexpected PR or commit notifications for development accounts, and report them through secure channels rather than from affected devices.