Nearly 5,000 GitHub accounts had credentials stolen and were used to push secret-stealing workflows into more than 1,800 repositories, according to an investigation by security firm Aikido Security. Over 4,837 hijacked accounts initiated malicious pull requests that aimed to abuse CI/CD pipelines to extract cloud credentials and other secrets.
How the Attack Worked
The malicious campaign kicked off with test pull requests titled “docs: dependency audit notes,” coming from branches named wfx-docs. These were used to check whether an account had write access to a repository. In total, around 61,764 repositories received these test pull requests; in roughly 1,806 of them, the attacker followed up by installing a CI workflow designed to steal secrets. After the workflow ran, the attacker almost always reverted the changes within about a minute and deleted the workflow run along with its logs to cover their tracks.
Even if the secret-stealer didn’t run, any account that submitted a test PR is considered compromised by Aikido. That’s because write permission to a repository alone opens up risk—even in projects a user doesn’t own. Many of the PRs were submitted through organization or collaborator access; over 10,400 such cases were identified.
Payload Capabilities & Indicators
The stealer is built to grab all secrets accessible via GitHub CI workflows. That includes GitHub Actions secrets, variables, OIDC tokens, the special GITHUB_TOKEN, and even credentials stored in the runner’s memory. It also targets credentials for cloud platforms including AWS, Azure, GCP, as well as tools like npm, PyPI, Kubernetes, SSH, and more. For self-hosted runners, the malware additionally collects metadata from instances, Docker container state, and other system-level data.
Indicators of compromise include specific branch names like wfx-docs, chore/[a-z0-9]{8}, or ci-check-[0-9]{4}; Pull request titles saying docs: dependency audit notes; commit messages that introduce workflows, helper scripts, or dependency audits; and a unique SHA-256 hash for the stealer script. The malware exfiltrated data via HTTP POST to two particular IP addresses.
Supply Chain Exposure & Package Risks
The attack wasn’t limited to CI workflows in code repos. At least one Packagist package version, digitalelvis/neuronai-studio version 3.14.3, was tagged as malicious. Multiple versions of a Go module, onuragtas/docker-env, were found to embed the stealer inside a workflow file—even though the Go code itself was unchanged. Users are recommended to remove those versions.
There’s also overlap seen between this wave and the so-called GhostAction attacks from October. Many accounts compromised in October were far more likely to be used again in this campaign. However, Aikido believes it’s too early to attribute this November campaign to the same actor, citing differences in tools, infrastructure, and techniques.
The scale of this incident—thousands of repositories, hundreds of publishers, and abuse of CI workflows—highlights emerging weaknesses in supply chain security. Stealing CI secrets and cloud credentials offers attackers a foothold that survives token rotation and reaches deep into infrastructure.
What this means: Anyone with write access to GitHub repos should assume all CI-connected secrets are compromised if their account matches any of the indicators. Rotate tokens, check permissions, audit workflows, and invalidate old credentials. Monitor for suspicious pull requests from branches like wfx-docs. Review recent package versions for malicious inserts. Stronger verification of collaborator access and tighter gating on CI actions will be essential to blunt attacks like this in the future.
