--- title: Compromised GitHub accounts push a CI secret stealer... description: A threat actor using stolen GitHub credentials has pushed a malicious CI workflow, dubbed WFX Phantom, into tens of thousands of repositories since November... canonical: https://daily.dev/posts/compromised-github-accounts-push-a-ci-secret-stealer-into-tens-of-thousands-of-repositories-fnxk1egjs twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Compromised GitHub accounts push a CI secret stealer into tens of thousands of repositories | daily.dev og:description: A threat actor using stolen GitHub credentials has pushed a malicious CI workflow, dubbed WFX Phantom, into tens of thousands of repositories since November... og:url: https://daily.dev/posts/compromised-github-accounts-push-a-ci-secret-stealer-into-tens-of-thousands-of-repositories-fnxk1egjs og:image: https://api.daily.dev/og/posts/FNxK1EGjs.png og:image:alt: Compromised GitHub accounts push a CI secret stealer into tens of thousands of repositories og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Compromised GitHub accounts push a CI secret stealer into tens of thousands of repositories **[Collections](https://daily.dev/sources/collections)** · 3 min read · 3 upvotes · 0 comments ## Summary A threat actor using stolen GitHub credentials has pushed a malicious CI workflow, dubbed WFX Phantom, into tens of thousands of repositories since November 10. Pull requests titled 'docs: dependency audit notes' from a `wfx-docs` branch are used as probes, and where write access exists a roughly 1,500-line shell script is pushed to the default branch before being reverted, sometimes within seven seconds. A November 12 snapshot indexed 62,246 such pull requests, and a separate count puts the figures at 4,837 compromised accounts opening probe pull requests in 61,764 repositories. About 6,500 repositories, 11% of those probed, ran the payload and exposed secrets including `GITHUB_TOKEN`, AWS/GCP/Azure credentials and AI API keys. The theft reached at least one Packagist package and one Go module, and overlaps with October's GhostAction campaign, though attribution isn't confirmed. ## Content Starting November 10 at 12:45:20 UTC, a botnet of hijacked GitHub accounts began opening pull requests across tens of thousands of repositories. The goal was to steal CI secrets, and then to hide that it had happened. The campaign has been called WFX Phantom, and also wfx-loot. ## How it works Every pull request was titled "docs: dependency audit notes" and came from a branch named `wfx-docs`. By a November 12 snapshot, GitHub search indexed 62,246 of them, and the wave was still going. The numbers on the scale of the operation: - 4,837 compromised accounts were used. - They probed 61,764 repositories for write access. - About 6,500 repositories, roughly 11%, actually ran the payload and exposed credentials. - Researchers confirmed secrets were stolen from at least 1,835 targets. Where a hijacked account had write access, the attackers pushed a roughly 1,500-line shell script, dubbed `wfx`, straight to the default branch. They did this through workflow edits or npm install hooks. GitHub Actions then ran it. Afterwards the attackers reverted the change and deleted the logs. Exposure windows were as short as seven seconds, and the whole cleanup took under a minute, so a maintainer glancing at the history later would see very little. ## What it takes The script goes after GitHub Actions secrets and the `GITHUB_TOKEN`. It also targets AWS, GCP, Azure, Docker and Kubernetes credentials, plus runner secrets such as AI provider API keys. It can exchange OIDC tokens for cloud sessions, which means a short-lived CI job can turn into real access to cloud infrastructure. ## Downstream spread The payload also reached at least one Packagist package and one Go module through automated publishing. That looks like a byproduct of repositories that release automatically, not a deliberate target. Still, it shows how a stolen write token can leak past the original repository. ## Link to earlier attacks The campaign overlaps with October's GhostAction attacks. Attribution to the same actor hasn't been confirmed. ## What to do I find the seven-second window the most unsettling detail. Nobody is going to catch that by watching. If your repositories are in the affected set, treat any secret that was available to Actions as exposed and rotate it. Check for `wfx-docs` branches and "docs: dependency audit notes" pull requests, and review recent workflow changes that were reverted shortly after being pushed. Restricting which accounts have write access, and limiting OIDC trust to specific branches, would shrink what a hijacked account can reach. ## Questions this post answers ### What is WFX Phantom and how does it steal secrets from GitHub repositories? WFX Phantom is a campaign using stolen GitHub credentials to push a roughly 1,500-line malicious shell script directly to a repository's default branch, let GitHub Actions run it, then revert the change, sometimes within seven seconds. It targets GitHub Actions secrets, `GITHUB_TOKEN`, AWS, GCP and Azure credentials, and runner secrets including AI provider API keys. _Maintainers hardening CI pipelines against credential theft can track emerging attack patterns like this on daily.dev._ ### How can I tell if my GitHub repository was targeted by the wfx-docs pull request attack? Check for pull requests titled 'docs: dependency audit notes' or branches named `wfx-docs`, and review workflow runs and commits that were quickly reverted. A November 12 snapshot found 62,246 such probe pull requests across 61,764 repositories from 4,837 compromised accounts, with about 6,500 repositories actually running the payload. _Developers auditing repository history for stealthy CI compromises can follow coverage like this on daily.dev._ ### Did the GitHub WFX Phantom secret-stealing campaign affect package registries beyond GitHub? Yes, the campaign reached at least one Packagist package and one Go module through automated publishing, meaning a stolen token in a release pipeline became a way into the broader package ecosystem. The campaign also overlaps with October's GhostAction attacks, though attribution to the same actor is not confirmed. _Teams assessing downstream supply chain exposure from compromised CI tokens can stay current via daily.dev._ ## Similar posts on daily.dev - [GhostAction Returns: Malicious “Security Audit” Workflows Now Mine Credentials from Entire Git Histories](https://daily.dev/posts/ghostaction-returns-malicious-security-audit-workflows-now-mine-credentials-from-entire-git-histo-9iwzmwu4v) · StepSecurity · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#github](https://daily.dev/tags/github), [#cicd](https://daily.dev/tags/cicd), [#github-actions](https://daily.dev/tags/github-actions) [View this post on daily.dev](https://daily.dev/posts/compromised-github-accounts-push-a-ci-secret-stealer-into-tens-of-thousands-of-repositories-fnxk1egjs) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Compromised GitHub accounts push a CI secret stealer into tens of thousands of repositories","url":"https://daily.dev/posts/compromised-github-accounts-push-a-ci-secret-stealer-into-tens-of-thousands-of-repositories-fnxk1egjs","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/compromised-github-accounts-push-a-ci-secret-stealer-into-tens-of-thousands-of-repositories-fnxk1egjs"},"datePublished":"2026-11-12T07:18:54.905Z","dateModified":"2026-11-12T22:46:57.608Z","description":"A threat actor using stolen GitHub credentials has pushed a malicious CI workflow, dubbed WFX Phantom, into tens of thousands of repositories since November...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1d34d16321d4712b2fcdb43ddc3cade1?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1d34d16321d4712b2fcdb43ddc3cade1?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/compromised-github-accounts-push-a-ci-secret-stealer-into-tens-of-thousands-of-repositories-fnxk1egjs","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":3},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,github,cicd,github-actions","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Compromised GitHub accounts push a CI secret stealer into tens of thousands of repositories"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/compromised-github-accounts-push-a-ci-secret-stealer-into-tens-of-thousands-of-repositories-fnxk1egjs#faq","mainEntity":[{"@type":"Question","name":"What is WFX Phantom and how does it steal secrets from GitHub repositories?","acceptedAnswer":{"@type":"Answer","text":"WFX Phantom is a campaign using stolen GitHub credentials to push a roughly 1,500-line malicious shell script directly to a repository's default branch, let GitHub Actions run it, then revert the change, sometimes within seven seconds. It targets GitHub Actions secrets, `GITHUB_TOKEN`, AWS, GCP and Azure credentials, and runner secrets including AI provider API keys. Maintainers hardening CI pipelines against credential theft can track emerging attack patterns like this on daily.dev."}},{"@type":"Question","name":"How can I tell if my GitHub repository was targeted by the wfx-docs pull request attack?","acceptedAnswer":{"@type":"Answer","text":"Check for pull requests titled 'docs: dependency audit notes' or branches named `wfx-docs`, and review workflow runs and commits that were quickly reverted. A November 12 snapshot found 62,246 such probe pull requests across 61,764 repositories from 4,837 compromised accounts, with about 6,500 repositories actually running the payload. Developers auditing repository history for stealthy CI compromises can follow coverage like this on daily.dev."}},{"@type":"Question","name":"Did the GitHub WFX Phantom secret-stealing campaign affect package registries beyond GitHub?","acceptedAnswer":{"@type":"Answer","text":"Yes, the campaign reached at least one Packagist package and one Go module through automated publishing, meaning a stolen token in a release pipeline became a way into the broader package ecosystem. The campaign also overlaps with October's GhostAction attacks, though attribution to the same actor is not confirmed. Teams assessing downstream supply chain exposure from compromised CI tokens can stay current via daily.dev."}}]} ```