wfx-loot: How 4,800 Hijacked GitHub Accounts Became a Multi-Cloud Credential Heist
Executive Summary
Executive Summary In November 2026, a supply-chain campaign dubbed 'wfx-loot' leveraged 4,837 compromised GitHub accounts to probe 61,764 repositories for write access, injecting a 1,500-line credential-stealing shell script into GitHub Actions workflows. Attackers harvested CI/CD secrets, AWS, Azure, and GCP credentials, OIDC tokens, and developer tool keys from at least 1,835 confirmed victims—including Fortune 100 firms, the US General Services Administration, and the French government. The script escalated cloud privileges by exchanging OIDC tokens for long-lived IAM credentials, then exfiltrated compressed data via HTTP POST before erasing traces within under a minute.
The wfx-loot campaign echoes the 2025 GhostAction attack and signals a maturing playbook in which adversaries weaponize trusted CI/CD pipelines to bypass perimeter controls entirely. With agentic AI credentials and Kubernetes service-account tokens now explicitly targeted, the blast radius of a single compromised workflow has expanded dramatically, forcing security teams to re-examine egress controls and secrets governance across every cloud environment.
Why This Matters Now
Why This Matters NowCI/CD pipelines have become the new perimeter, and attackers know it. The wfx-loot campaign shows that stolen GitHub credentials are now weaponized at scale to chain into multi-cloud IAM privilege escalation in seconds—while most organizations still lack egress controls or anomaly detection on workflow-generated cloud traffic, leaving the door open to silent, long-lived compromise.
Attack Path Analysis
Attack Path AnalysisIn the wfx-loot campaign, attackers leveraged 4,837 previously stolen GitHub credentials to probe tens of thousands of repositories for write access, then injected malicious GitHub Actions workflows containing a 1,500-line credential-stealing shell script that harvested cloud credentials, tokens, and secrets from CI/CD environments. The stolen secrets enabled cloud privilege escalation via OIDC token exchange, lateral movement across AWS, Azure, and GCP environments, and silent exfiltration of compressed credential bundles to attacker-controlled HTTP endpoints, with evidence cleanup completed in under a minute to avoid detection.
Kill Chain Progression
Kill Chain ProgressionThis analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
DescriptionAttackers used 4,837 compromised GitHub account credentials—sourced from prior infostealer campaigns—to authenticate to GitHub and probe 61,764 repositories for write access. Pull requests disguised as dependency audit notes ('docs: dependency audit notes') were opened to test permissions. The CNSF fabric's real-time inspection and inline enforcement capabilities could have flagged the anomalous volume of automated pull request activity originating from compromised identities, while cloud firewall URL filtering could have blocked access to attacker-controlled probing infrastructure.
MITRE ATT&CK® Techniques
MITRE ATT&CK® TechniquesCompromise Accounts: Cloud Accounts
Supply Chain Compromise: Compromise Software Dependencies and Development Tools
Unsecured Credentials: Credentials In Files
Unsecured Credentials: Private Keys
Valid Accounts: Cloud Accounts
Serverless Execution
Exfiltration Over C2 Channel
Indicator Removal: File Deletion
Potential Compliance Exposure
Potential Compliance ExposureMapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – User and System Account Management
Control ID: Requirement 8.2 / 8.6
NYDFS 23 NYCRR 500 – Access Privileges and Monitoring of Authorized Users
Control ID: Section 500.7 / 500.14
DORA (EU) 2022/2554 – ICT Security and Access Control / Detection Capabilities
Control ID: Article 9 / Article 10
CISA Zero Trust Maturity Model 2.0 – Least Privilege Enforcement and Workload Identity Validation
Control ID: Identity Pillar: Credential Management / Application & Workload Pillar: CI/CD Security
NIS2 Directive (EU) 2022/2555 – Risk Management Policies and Supply Chain Security
Control ID: Article 21(2)(a) / 21(2)(e)
ISO/IEC 27001:2022 – Configuration Management / Secure Development Lifecycle / Security Testing in Development
Control ID: Annex A 8.9 / 8.25 / 8.29
Sector Implications
Sector ImplicationsIndustry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
Supply-chain infostealer campaign targeting 61,764 GitHub repositories exposes CI/CD secrets, cloud credentials, and npm/PyPI publishing rights, enabling downstream code injection across software ecosystems with insufficient egress controls.
Information Technology/IT
Compromised AWS, Azure, and GCP credentials via GitHub OIDC token exchange enables persistent IAM privilege escalation, demanding zero-trust segmentation and multicloud visibility to detect lateral movement across hybrid cloud environments.
Computer/Network Security
Stolen Vault, Kubernetes, Docker, and SSH credentials from Fortune 100 and government-linked accounts undermine identity trust boundaries, exposing gaps in egress policy enforcement and anomaly detection across security toolchains.
Financial Services
Long-lived IAM credentials harvested from compromised CI pipelines create persistent unauthorized cloud access, violating PCI 4.0 and NIST 800-53 SC-7 controls governing data-in-transit protection and privileged identity governance.
Sources
Sources- Hackers compromise 4,800 GitHub accounts to steal cloud credentialshttps://www.bleepingcomputer.com/news/security/hackers-compromise-4-800-github-accounts-to-steal-cloud-credentials/Verified
- Aikido Security: Compromised GitHub Accounts Push CI Secret Stealer to Tens of Thousands of Repositorieshttps://www.aikido.dev/blog/compromised-github-accounts-push-ci-secret-stealer-to-tens-of-thousands-of-repositoriesVerified
- Hackers steal 3,325 secrets in GhostAction GitHub supply-chain attackhttps://www.bleepingcomputer.com/news/security/hackers-steal-3-325-secrets-in-ghostaction-github-supply-chain-attack/Verified
- CISA: Security Best Practices for GitHub Actionshttps://www.cisa.gov/news-events/cybersecurity-advisoriesVerified
- GitHub Docs: Security hardening for GitHub Actionshttps://docs.github.com/en/actions/security-guides/security-hardening-for-github-actionsVerified
- Over 543,000 valid credentials exposed in public GitHub repositorieshttps://www.bleepingcomputer.com/news/security/over-543-000-valid-credentials-exposed-in-public-github-repositories/Verified
Frequently Asked Questions
Frequently Asked QuestionsCloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
The wfx-loot campaign exploited CI/CD identity trust chains across AWS, Azure, and GCP to escalate privileges, move laterally, and silently exfiltrate credential bundles—exactly the class of multi-environment, east–west, and egress-driven attack that Aviatrix Zero Trust CNSF is positioned to constrain. By enforcing workload-scoped segmentation, identity-aware routing, and controlled egress policies across cloud environments, Aviatrix would likely have reduced the attacker's reachability and limited the blast radius of compromised CI/CD credentials.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Anomalous outbound connection patterns from CI/CD runner environments to attacker-controlled probing infrastructure would likely have been flagged by real-time inline inspection, potentially reducing the attacker's ability to operate undetected across the initial reconnaissance phase.
Control: Zero Trust Segmentation
Mitigation: Identity-aware segmentation policies would likely constrain OIDC token exchange to pre-approved roles and workload namespaces, reducing the attacker's ability to chain into additional IAM roles and generate persistent long-lived credentials across multiple cloud providers.
Control: East-West Traffic Security
Mitigation: Workload-to-workload segmentation policies would likely reduce the attacker's ability to pivot between cloud environments using compromised credentials, constraining cross-environment API reachability and limiting the scope of lateral access available from a single set of stolen tokens.
Control: Multicloud Visibility & Control
Mitigation: Centralized traffic observability across multicloud environments would likely surface anomalous outbound HTTP POST connections originating from CI/CD runner workloads, potentially reducing the attacker's ability to operate a covert command channel without generating detectable traffic anomalies.
Control: Egress Security & Policy Enforcement
Mitigation: Outbound FQDN filtering and egress policy enforcement would likely block HTTP POST transfers to unknown attacker-controlled destinations, reducing the volume of credential bundles successfully exfiltrated from CI/CD runner environments to external endpoints.
Had earlier-stage controls constrained privilege escalation and lateral movement, the number of cloud environments reachable with stolen credentials would likely have been smaller, reducing the pool of organizations exposed to downstream supply chain poisoning and persistent cloud access via modified IAM trust policies.
Impact at a Glance
Affected Business Functions
- CI/CD Pipeline Integrity and Software Build Systems
- Cloud Infrastructure Access Management (AWS, Azure, GCP)
- Open-Source Package Distribution (npm, PyPI, Go, crates, Packagist)
- Developer Credential and Secret Management
Estimated downtime: 3 days
Estimated loss: N/A
Confirmed theft of CI/CD secrets from at least 1,835 repositories spanning Fortune 100 organizations, US General Services Administration, French government entities, and major open-source projects. Stolen data categories include: GitHub Actions secrets and GITHUB_TOKEN values, OIDC and Actions runtime tokens, AWS/Azure/GCP cloud credentials including instance metadata credentials on self-hosted runners, SSH, GPG, Docker, Kubernetes, npm, PyPI, Vault, and Terraform credentials, AI service API keys for OpenAI, Anthropic, Gemini, Hugging Face, Cursor, and GitHub Copilot, environment variables and .env files, private keys and keystores, shell histories, process memory dumps, repository files and recent commits, and workflow run artifacts. The attacker also demonstrated capability for cloud privilege escalation including creation of long-lived IAM credentials in AWS and GCP identity impersonation. Payload was injected into at least two public package releases (Packagist and Go module), creating downstream supply-chain exposure risk for all consumers of those packages.
Recommended Actions
Key Takeaways & Next Steps
- • Apply Egress Security & Policy Enforcement with FQDN-based outbound filtering on CI/CD runner environments to block unauthorized HTTP POST exfiltration to attacker-controlled endpoints, and enforce allowlist-only egress policies for GitHub Actions self-hosted runners across AWS, Azure, and GCP.
- • Deploy Zero Trust Segmentation with identity-based policy and least-privilege IAM controls to restrict OIDC token exchange to pre-approved cloud roles and namespaces, preventing privilege chaining from GitHub OIDC tokens into long-lived IAM credentials or GCP service account impersonation.
- • Enable Multicloud Visibility & Control with centralized traffic observability and anomaly baselining across CI/CD pipelines to detect abnormal pull request volumes, automated workflow triggers from unexpected accounts, and anomalous cross-cloud API call patterns indicative of lateral credential abuse.
- • Leverage the Cloud Native Security Fabric (CNSF) for real-time inline enforcement and distributed policy inspection across cloud control planes to identify and block automated credential-harvesting workflow injections before script execution, using behavioral detection of CI/CD pipeline manipulation patterns.
- • Activate Cloud Firewall (ACF) with AI-driven discovery of outbound traffic to enforce internet egress controls on CI/CD infrastructure, ensuring that compressed tarball uploads and HTTP POST callbacks to unknown external destinations are blocked and alerted on before exfiltration completes.
