-5.png?w=1024)
One stolen developer account can open the door to dozens of repositories. Hackers have apparently found a way to turn that access into a supply chain attack on a much larger scale.
A campaign tracked as wfx-loot involved 4,837 compromised GitHub accounts and reached 61,764 repositories, according to security researchers at Aikido. The attackers used stolen credentials to probe repository permissions and introduce malicious GitHub Actions workflows designed to steal additional secrets.
Aikido researchers say the malware harvests sensitive information, including GitHub access tokens and cloud credentials, as well as API keys for AI services. Its capabilities also extended to persistence, raising the possibility that a compromised development pipeline could become a longer-term entry point into an organization's infrastructure.
How stolen tokens opened access to thousands of repos
The attackers did not need to compromise each repository individually. Instead, they used stolen GitHub credentials belonging to developers who already had access to multiple projects.
A developer might contribute to several open-source repositories while also holding permissions within an employer's GitHub organization. If attackers obtain that developer's credentials, they may be able to access multiple projects without exploiting a separate vulnerability in each one.
According to Aikido, the campaign included suspicious pull requests titled docs: dependency audit notes, which researchers linked to the attackers' efforts to identify potential targets. The earliest activity Aikido reported was recorded on Nov. 10 at 12:45 UTC.
The campaign's reach was substantial, but the reported figures describe different stages of the attack. Aikido identified activity involving 61,764 repositories, while SafeDep separately reported 8,093 repositories that received malicious commits.
Researchers have not established how the attackers originally obtained the compromised credentials. Phishing, infostealer malware, exposed tokens, and third-party integrations remain possible explanations, but none should be treated as confirmed.
How to know if you were affected
Aikido recommends that developers and organizations check every GitHub repository they can write to, including those accessed through collaborator or organization permissions. Review activity from Nov. 10 for these indicators:
- Pull requests: docs: dependency audit notes
- Branches: wfx-docs, chore/[8 random characters] and ci-check-[4 digits]
- Commit messages: ci: refresh build cache, ci: restore, chore: add ci helper, ci: cleanup and chore: add dependency audit workflow.
- You can check for a stealer script with this hash: 89695abb392d5cfd4972672961e644bb46baa98aa1ed7173c2a2816c762735cf
Finding the probe pull request alone warrants action even if nothing else ran.
If malware executed, assume accessible secrets and cloud credentials were exposed. Revoke and rotate affected tokens and API keys, inspect cloud IAM policies and federated identity configurations, and investigate self-hosted runners and developer machines where malicious npm scripts may have executed.
Aikido also recommends that existing users check the Aikido security feed, filter for malware issues, and trigger a manual rescan. Non-users can connect their repositories through its free plan, which includes malware detection.
The real security problem here is access
Since cyberattacks began, one thing has remained consistent: attackers' need for access, and they've found plenty of ways to get it.
Phishing, infostealer malware, and exposed credentials are just some of the methods they use. We still don't know how the wfx-loot attackers obtained the GitHub tokens, but these remain possible routes. Repository compromises are hardly new in cybersecurity, either.
That uncertainty makes this a useful reminder for enterprises that rely on developers: developers are prime targets because their accounts can open doors to far more than source code.
Organizations should treat developer accounts and CI/CD workflows as high-value security assets. Strong authentication, least-privilege permissions, regular access reviews, and tighter controls over workflow secrets can help limit the damage from stolen credentials.
Security teams should also monitor unusual repository changes, unexpected workflow modifications, and suspicious use of access tokens. Where possible, short-lived credentials and narrowly scoped permissions can reduce how much an attacker can access.
The lesson from wfx-loot is not simply that developer credentials can be stolen. It's how much damage those credentials can enable when one account has access to an entire network of repositories and automated systems.
Researchers from Cornell Tech and Yale University found that AI agents could bypass cryptocurrency spending limits by retrieving email verification codes, with nine of 10 tested models raising their own limits without separate human approval, exposing weaknesses in automated payment safeguards.