Short answer: On 12 November 2026 Aikido Security published a write-up of a campaign it is tracking as wfx-loot. It says that, starting on 10 November, a threat actor used stolen GitHub credentials to push a malicious workflow payload into tens of thousands of repositories, with the aim of stealing GitHub Actions secrets and cloud credentials. Aikido’s figures, as stated on that page when we fetched it, include 4,837 compromised accounts that opened probe pull requests in 61,764 repositories, and at least 1,835 repositories where the payload ran and credentials were exfiltrated. The same post also says researchers had indications the payload ran in at least 1,806 repositories, a number that may understate impact; we are not reconciling those two run-count figures. If you maintain Actions workflows, check the indicators Aikido published, treat secrets as compromised if a malicious workflow ran, and keep dated copies of the workflow files and the incident note you actually wrote. A TimeBind cannot detect malware, rotate a secret, or prove that an account was or was not hijacked. It can date the exact files and notes you kept.
Last checked 12 November 2026. General information for software developers and maintainers, not incident-response, legal or security-advisory advice. Figures and indicators below are what Aikido Security published on 12 November 2026, as fetched the same day; they may be revised. This page does not tell you how to build, test or deploy malware, and it does not reproduce payload files or network infrastructure. If you think a workflow ran in a repository you can write to, follow current guidance from the researchers and from GitHub, and rotate credentials through your own process.
Table of Contents
What researchers published on 12 November 2026
Aikido Security’s post, written by Oliver Smith and published 12 November 2026, is the primary source for the figures on this page. We fetched it the same day. The Hacker News and Endor Labs also wrote about the campaign on 12 November; treat those as supporting coverage of the same researcher findings, not as a second set of numbers.
Aikido says the campaign started on 10 November. Stolen GitHub credentials were used to open a probe pull request and, where write access allowed, to push a malicious workflow that steals GitHub Actions secrets and cloud credentials. Aikido is tracking the campaign as wfx-loot. It says the payload has also appeared in at least one Packagist package and one Go module through automated publishing, but that the actor appears to be targeting CI secrets rather than spreading mainly through the package supply chain.
The figures Aikido stated on that page, based on data it had collected at the time, were: 4,837 compromised accounts opened probe pull requests in 61,764 repositories; at least 1,835 repositories ran the payload and had credentials exfiltrated; In a later paragraph the same post says researchers had identified indications that the payload ran in at least 1,806 repositories, and that this number may understate impact because run logs were deleted. Those are Aikido’s figures as published on 12 November 2026. We are not merging them into a single official count, and we are not certifying the scope of any one repository.
Aikido published indicators maintainers can look for, including a wfx-docs branch and a pull request titled docs: dependency audit notes, plus several commit titles it associates with the follow-on payload. It says the probe confirms write access, and that if the probe ran the user is compromised even if a later workflow stage did not run. If the payload itself ran, Aikido says to assume every secret and cloud role available to the workflows is compromised. It also noted that many public probe pull requests were still open when it looked.
This is a different incident from the bee-js npm compromise covered earlier on this site. See what developers should keep after the bee-js npm compromise if that is the event you are dealing with. Do not treat a TimeBind of a lockfile as a substitute for reading the current researcher post and for rotating credentials.
Why dated records matter in a CI incident
When a workflow file is changed, reverted and a run log is deleted, it can be hard to reconstruct what was in the repository at a given moment. A dated copy of the workflow YAML you actually had, of a lockfile or manifest, and of a short incident note (what you checked, when, and what you rotated) will not clean a runner or close a pull request. It can show that those exact files and notes existed no later than a recorded time and still match.
Demand around this write-up was concentrated on 12 November. Aikido’s own account, @AikidoSecurity, posted about the campaign that day; the post had 35,698 impressions in our in-window measurement. Across 25 in-window posts matching the query, impressions summed to 41,367. Google autocomplete in the United States on 12 November 2026 did not yet return suggestions for those phrases, which is unsurprising for a story that broke the same day.
If an automated publish ran, Aikido listed specific package versions in its post. Check that list on their page rather than relying on a summary here, because the list can grow. A dated note of the versions you checked, and of whether any were installed, is useful later. See also what to keep if you opt out of Copilot or Cursor training and what records to keep if an agent deletes files, which are about different problems and different records.
Practical checklist for developers and maintainers
- Read the current Aikido post, and GitHub’s own security guidance, before you assume you are or are not affected. Figures and package lists can be revised. Save the wording and the date of the page you relied on.
- Search your organisations for the indicators the researchers published. Aikido named a
wfx-docsbranch, a pull request titledocs: dependency audit notes, and several commit titles associated with the payload. Look those up in their post. This page does not add new indicators and does not reproduce payload files. - If a probe pull request or a malicious workflow ran, treat credentials according to the researchers’ advice. Rotation, revocation and access review happen in your own process, not in a timestamp.
- Keep dated copies of the workflow files as they stood, including after a revert. A missing run in the Actions history may be the only obvious trace, according to Aikido. Your own dated export of
.github/workflows, and of any hook or helper file you actually had, is easier to compare later than a memory of a revert. - Keep the lockfile or manifest you would use to see what was installed, and a short note of any package versions you checked against the researcher list. Aikido reported that a small number of published packages picked up the payload through automated publishing. Check their current list. See the bee-js npm page for a different, earlier package incident.
- Write an incident note in your own words: what you searched, what you found, what you rotated, and when. Date that note with the workflow export. A TimeBind of a zip of those files records that exact pack, not that the incident is closed.
- Date the pack you would actually hand to a colleague or an incident channel. A TimeBind of that zip lets you show that those exact files existed no later than a recorded time and still match. It does not prove the account was clean, and it does not prove it was hijacked.
What a TimeBind does and does not show
A TimeBind is a dated, checkable record that an exact file existed no later than a recorded time and still matches. The SHA-256 fingerprint is made in your browser and the file is never uploaded. The record is anchored to Bitcoin (a Merkle root in an OP_RETURN). Your first Pooled TimeBind is free; after that, TimeBinds start from US$5, and an ASAP TimeBind is US$15. See how it works.
Here it is useful for a folder of workflow YAML, a lockfile, a screenshot or export of a pull-request list, and the incident note you actually wrote. It is not a malware scan and it is not a substitute for rotating a secret.
A TimeBind does not detect a secret stealer, does not show that a runner was clean, does not revoke a token, and does not prove who controlled a GitHub account on a given day. It is one piece of a timeline of the files you kept.
Limits
This article summarises Aikido Security’s 12 November 2026 post, read the same day, and supporting coverage published that day. It is not a security advisory, not an official GitHub statement, and not a complete indicator list. We are not certifying that any repository, package or account was or was not affected. We are not providing exploit details, payloads or reproduction steps. If you need to respond to a suspected incident, use current researcher and platform guidance, and your own security process. This page is not legal or professional-security advice.
Tools that can help
Use the bulk SHA-256 manifest for a folder of workflow files, lockfiles and an incident note, and keep a dated copy of the exact set you would show a colleague.
A neighbouring habit, before a compromised action is in play, is to pause and lock workflow dependencies. The free GitHub Actions workflow lockfile checklist looks at the current docs and the exact copies to keep. Locking does not show that an action is safe.
If the workflow publishes to npm, see also the free npm trusted publishing checklist. It looks at the trusted publisher settings, old tokens and the exact copies to keep. It is not a security audit.
If the workflow publishes a Python package, see also the free PyPI trusted publishing checklist. It looks at what you trust, the publish job, old API tokens and the exact copies to keep. It is not a security audit.
If an AI coding assistant may have saved a password or key in a project file, see also the free AI coding assistant settings file secrets checklist. It puts the steps in order, rotate first, then clean up, and cannot show whether a key was used.
Frequently Asked Questions
-
Is this the same event as the bee-js npm compromise?
No. The bee-js incident is covered in a separate article. Aikido’s 12 November 2026 post describes a campaign that started on 10 November and is aimed at GitHub Actions secrets, with a small number of packages affected through automated publishing. Read the researcher post for the current package list.
-
Do I need to rotate secrets if I only saw a probe pull request?
Aikido says that if the probe ran, the user is compromised even if a later workflow stage did not run, and that if the payload ran you should assume every secret and cloud role available to the workflows is compromised. Follow current researcher and GitHub guidance. A dated note of what you decided is useful; a TimeBind does not rotate anything.
-
Will a TimeBind tell me whether a workflow was malicious?
No. A TimeBind is a dated, checkable record that an exact file existed no later than a recorded time and still matches. It does not detect malware or interpret a YAML file.
-
Why are there two different “payload ran” figures in the Aikido post?
The post states at least 1,835 repositories ran the payload and had credentials exfiltrated, and separately that researchers had indications the payload ran in at least 1,806 repositories, a number that may understate impact. Those are Aikido’s figures as published on 12 November 2026. We are not reconciling them.
-
Can you publish the payload or the callback addresses so I can hunt for them?
No. This page points to the public researcher write-up for the indicators they chose to publish. It does not reproduce payload files, network infrastructure or attack procedures.
Sources checked
- Aikido Security, Oliver Smith, “wfx-loot campaign pushes CI secret stealer to tens of thousands of repositories,” 12 November 2026, https://www.aikido.dev/blog/compromised-github-accounts-push-ci-secret-stealer-to-tens-of-thousands-of-repositories (fetched 12 November 2026)
- The Hacker News, “Attacker Used 4,837 Hijacked GitHub Accounts to Run a CI Secret Stealer in 1,806+ Repositories,” 12 November 2026, https://thehackernews.com/2026/11/4837-hijacked-github-accounts-ran-ci.html (supporting coverage, fetched 12 November 2026)
- Endor Labs write-up of the same campaign, 12 November 2026 (supporting; fetched 12 November 2026)
- X, @AikidoSecurity, 12 November 2026, 35,698 impressions as measured from in-window search (25 in-window posts, sum 41,367 impressions)
Date the workflow files and incident note you keep yourself
Your first Pooled TimeBind is free, with no credit card required. After that, TimeBinds start from US$5, and an ASAP TimeBind is US$15. Click here to start, or see plans and pricing.
