Compromised GitHub accounts pushed a CI secret stealer into tens of thousands of repositories

Aikido Security says a threat actor used stolen GitHub credentials, starting on 10 November, to push a secret-stealing payload into tens of thousands of repositories. In the figures it has collected so far, 4,837 compromised accounts opened probe pull requests in 61,764 repositories, and at least 1,806 repositories ran the payload. The firm says that count may understate the impact, because the run logs were then deleted.

You may be affected if, on or after 10 November, a repository you can write to showed a branch named wfx-docs, a pull request titled docs: dependency audit notes, short-lived branches named chore/ followed by eight random characters, or commits titled ci: refresh build cache, chore: add ci helper or chore: add dependency audit workflow. Aikido’s Oliver Smith also lists companion cleanup messages such as ci: restore and ci: cleanup. GitHub’s public pull-request search, the firm says, returned 61,839 pull requests with that decoy title between 10 and 11 November. Of those, 10,431 went into repositories the account does not own, reached through collaborator or organisation access, and 92% were still open when Aikido published.

If the probe ran, Aikido says that user is already compromised, even if the later workflow stage did not run. If the payload itself ran, treat every secret and cloud role available to the repository’s workflows as compromised.

The campaign does not need you to merge the decoy pull request. Aikido describes a short-lived change that can be added to an existing workflow, introduced on a throwaway branch, or, in one variant, attached as an install hook in a Node project. The change is then reverted, often within a minute, and the workflow run is deleted. A missing run number in the Actions history is often the only remaining sign.

Aikido published a technical teardown, with the indicators above, on 12 November.

Massive GitHub Actions CI Secret Stealer. 4,800+ compromised accounts attempted to push malicious workflows to 61k+ repos. Payload dumps all CI secrets, memory, OIDC and commit secrets, then instantly deletes run logs.

November 12, 2026

Independent of that write-up, developer Xander Steenbrugge has published a first-hand account. He says an old classic personal access token on his GitHub account was used to plant the same pattern, and that he noticed when a git push was rejected because two commits he had not made had landed on his main branch under his own name. He then searched GitHub’s public pull-request index for the same decoy title and reported 15,369 matches on 10 November and 46,685 on 11 November, with none on the nine days before. In a sample of 20,636 of those pull requests, he counted 2,226 distinct accounts and said 93% of the sampled requests were still open a day later. About one in five, in that sample, landed in a repository the account holder does not own.

Yesterday, an old access token in my GitHub account got compromised and a swarm of agents exfiltrated all GitHub CI secrets they could reach. Turns out the same attack opened ~62,000 pull requests across GitHub in 26 hours, from thousands of different accounts.

November 11, 2026

Steenbrugge also points to a trace that survives the deleted run: in the account’s security log, a search for workflow-run deletions you did not make. He says the token was a classic personal access token from 2022, with broad rights, no expiry, and admin access to 158 repositories, many of them old collaborations.

Aikido says the payload collects GitHub Actions secrets and variables, the workflow token, cloud credentials obtained through GitHub’s identity federation with AWS, Google Cloud and Azure, secrets from recent commits and builds, and credential material from the runner’s environment and memory, including keys for AI providers and developer tools. It also says some of the payload’s options are designed to outlast a simple secret rotation, including by changing cloud identity trust settings. If a workflow ran, review AWS, Azure and related identities, not only the secrets stored in GitHub.

Aikido says the operator is targeting CI and cloud credentials. Automated publishing still carried the payload into at least two packages it has named: Packagist digitalelvis/neuronai-studio version 3.14.3, and the Go module github.com/onuragtas/docker-env at tags v1.0.278 and v1.0.280. Aikido says those Go tags hold the payload in a GitHub Actions workflow file only, the Go source and release binaries are unchanged, and Go builds do not run workflow files, though it still recommends removing the packages. The GitHub repository for that module now redirects to onuragtas/redock, which still lists those tags. Packagist still lists version 3.14.3, dated 11 November, alongside a development version named for the wfx-docs branch. Aikido says to treat any machine that installed or opened the named Packagist version as compromised.

Steenbrugge separately counted about 1,680 public commits of the install-hook variant, across 782 repositories, and said the webdriverio project was among them, reached through its bot account. Of 94 affected projects that publish to npm and that he checked, he says none had shipped a release since the wave.

Accounts used in this wave overlap with October’s GhostAction activity, Aikido says, and accounts hit in October were far more likely to appear again in November. In more than 100 repositories, it says, the November payload was injected into the earlier workflow files. It does not attribute the November campaign to the same actor: the infrastructure and tooling differ, and stolen credentials often end up with more than one operator.

The full list of indicators of compromise: PRs: docs: dependency audit notes. Branches: wfx-docs or chore/[a-z0-9]{8}. Commits: ci: refresh build cache, chore: add ci helper, or ci: cleanup. Anomalies: Missing workflow run numbers in your Actions history. If this payload ran in your repository, assume total credential compromise. Rotate all repository secrets, AI provider keys, and cloud roles immediately.

November 12, 2026

Aikido also published network indicators in its post. Steenbrugge’s advice, if you find the signs above, is to revoke the token, review classic and fine-grained personal access tokens plus authorised OAuth apps and GitHub Apps, and rotate every Actions secret in every repository that token could administer. Aikido’s advice is the same in spirit: if the payload ran, assume total credential compromise and rotate repository secrets, provider keys and cloud roles immediately, then look at cloud trust as well.