Three counts, three different events
Aikido and SafeDep counted different stages of the same attack, and each stage has its own number. Probe counts establish attempted reach, not confirmed execution or credential theft.
61,764 repositories received a probe: a pull request titled "docs: dependency audit notes", opened from a branch named wfx-docs, whose only job was to test whether the stolen account could write to that repository. Aikido counted 10,431 probes into repositories the compromised account did not own, reached through collaborator or organization access, and 92% were still open when Aikido checked.
8,093 repositories received a malicious commit, on SafeDep's count of public default branches between November 10 and the early hours of November 12. In 7,309 the stealer was added to an existing workflow. In 771 it arrived as an npm postinstall hook, which also runs on a developer's own machine during npm install. SafeDep also identified a third delivery variant; these two categories do not exhaust its 8,093-repository total.
Aikido reports at least 1,835 repositories where the payload ran and credentials were exfiltrated. Elsewhere, it cites indications of execution in at least 1,806 repositories. The report gives both figures without reconciling them; neither should be silently substituted for the other.
The deleted run is the point
After running once, the attacker reverted the change within at most one minute, and deleted the workflow run along with its logs. Aikido is explicit about what that means for anyone checking: the absence of wfx-loot artifacts, wfx- cache entries or step summaries does not show that nothing was taken. The more reliable trace is a gap, a missing run number in the repository's Actions history on a commit the owner does not recognize.
It also means neither execution figure can be treated as the total. Both counts may understate impact, because execution traces were deleted and SafeDep's inventory covers public default branches only.
Rotation does not close every door the script opened
The payload is a single shell script of about 1,500 lines that collects, escalates, persists and exfiltrates. Aikido describes persistence steps that apply where the payload obtains the necessary cloud access, and they are the part a standard secret rotation misses. On Azure, it adds federated identity credentials named wfx-ci-… to Azure AD applications, so a workflow in the compromised repository can authenticate with no stored secret at all, after every token has been rotated. On AWS, it rewrites a chained role's trust policy to allow any AWS account. Early in the run it also posts forged success status checks under the names of a repository's required checks, because branch protection matches the check's name rather than who posted it.
The collection list is broad: Actions secrets and variables, the workflow token, OIDC tokens it exchanges for AWS, Azure and GCP sessions, credential files for the major clouds, and keys for AI services including OpenAI, Anthropic, Gemini, Hugging Face, Cursor and Copilot. The payload also reached at least one Packagist package and one Go package through automated publishing triggers. SafeDep advises blocking Packagist digitalelvis/neuronai-studio v3.14.3, which Packagist was still serving as the latest version when it checked, and pinning v3.14.2 or earlier.
What to check
Any repository you can write to deserves a search for the probe title and the wfx-docs branch since November 10. Aikido's position is that if the probe ran from an account, that account is compromised even if the workflow stage never executed. From there: identify the compromised account associated with the probe and revoke its tokens, OAuth grants, SSH keys and sessions; rotate every secret the repository's workflows could reach; and inspect cloud accounts for the additions the script makes, the Azure federated credentials and AWS trust-policy changes in particular.
Sources
- [1] Aikido Security, "wfx-loot campaign pushes CI secret stealer to tens of thousands of repositories," Nov 12, 2026Read source
- [2] SafeDep, "wfx: GitHub Actions Credential Stealer Hits 8,000 Repos," Nov 12, 2026Read source
- [3] Cloud Security Alliance, "The wfx Campaign: Hijacked GitHub Accounts Harvest CI Secrets," Nov 12, 2026Read source
- [4] The Hacker News, "Attacker Used 4,837 Hijacked GitHub Accounts to Run a CI Secret Stealer in 1,806+ Repositories," Nov 12, 2026Read source