Since about 12:45 UTC on 10 November 2026, an unknown attacker has been using stolen credentials for 4,837 GitHub accounts to open probe pull requests in 61,764 repositories, security firm Aikido reports. StepSecurity counted more than 63,000 probe pull requests by 07:40 UTC on 12 November, about 90% still open, with new ones appearing every few minutes. Aikido tracks the campaign as wfx-loot; StepSecurity calls the malware WFX Phantom. GitHub has not commented in either report.
How it works: the probe is a pull request titled docs: dependency audit notes from a branch named wfx-docs. It checks whether the stolen token can write to the repository. Where it can, the attacker pushes a roughly 1,500-line shell script: a new step in an existing workflow (commit ci: refresh build cache), a new workflow on a throwaway chore/ branch, a hidden .ci-*.sh script run by an npm postinstall hook, or extra lines in a shell script the repository already runs. Within about a minute it reverts the change (ci: restore or ci: cleanup) and deletes the workflow run and its logs. Both firms say a missing run number in the Actions tab may be the only trace left.
What it steals: all repository secrets, tokens, environment variables, runner memory, and credential files for AWS, Azure, Google Cloud, Docker, Kubernetes, npm, PyPI, SSH, Vault and AI services. It uses the job's OIDC token to get cloud sessions, and it can leave backdoors that survive a normal secret rotation: AWS role trust policies rewritten to allow any principal ("Principal": {"AWS": "*"}) and Azure federated credentials named wfx-ci-…. Aikido found the payload ran and data was sent out in at least 1,835 repositories and says that may be an undercount. StepSecurity names nextcloud/docker and webdriverio among the projects hit; in WebdriverIO, commits were pushed as the project's bot account.
Packages: at least 50 compromised users publish packages on npm, Go, Packagist, PyPI or crates. Affected releases named so far are Packagist digitalelvis/neuronai-studio 3.14.3, Go github.com/onuragtas/docker-env v1.0.278 and v1.0.280, and a pseudo-version of github.com/vkuznet/gocurl (StepSecurity). For the Go module, the payload is only in workflow files. Aikido sees overlap with October's GhostAction campaign but thinks a different actor is behind this one. Data was first sent by HTTP to servers on port 8080; StepSecurity says that by early 12 November the stealer had switched to Telegram.
