WFX Phantom: stolen GitHub tokens push a CI secret stealer into repositories from 2026-11-10, steal Actions secrets, runner memory and cloud tokens, plant AWS and Azure persistence designed to outlast rotation and delete the workflow runs; StepSecurity counts more than 63,000 probe pull requests

StepSecurity reports that from 2026-11-10 an attacker uses stolen GitHub tokens of real developer and bot accounts, as a developer would, not a bug in GitHub Actions, to push a CI secret stealer into repositories those tokens can write to (StepSecurity, 2026-11-12). It first opens a pull request titled "docs: dependency audit notes" from a branch named wfx-docs that only proves write access; StepSecurity counts more than 63,000 such probes by 2026-11-12 (StepSecurity, 2026-11-12), Aikido, which tracks the campaign as wfx-loot, counts 4,837 compromised accounts and at least 1,835 repositories where the payload ran, and Endor Labs counts 8,926 infected repositories (Aikido, 2026-11-12; Endor Labs, 2026-11-12); BleepingComputer reports that the compromised accounts included those of the US General Services Administration and the French government (BleepingComputer, 2026-11-12).

Where the token's permissions and the repository's setup let it run, the attacker pushes a script of about 1,500 lines through an edit to an existing workflow or CI shell script, a new workflow on a short-lived branch or a hidden script that an npm hook runs, and the script collects every Actions secret, the job token, the memory of the runner worker process and credential files for the major clouds and registries, then uses the job's OIDC token to open AWS, GCP and Azure sessions (StepSecurity, 2026-11-12). It plants persistence meant to outlast rotation, a rewritten AWS role trust policy with new access keys and federated identity credentials on Azure applications, sends the archive over HTTP and from 2026-11-12 through a Telegram bot, and within about a minute pushes a revert commit and deletes the workflow run, leaving a gap in the run numbers that StepSecurity calls the most reliable sign the stealer ran (StepSecurity, 2026-11-12). How the tokens were obtained is not known: some probes came through the Fly.io GitHub App, and StepSecurity has no evidence of a breach of Fly.io (StepSecurity, 2026-11-12). BleepingComputer's report of Aikido's findings gives the same probe title and start date (BleepingComputer, 2026-11-12).

Triage: a probe pull request alone shows that the account that opened it is compromised, even if nothing else happened; the payload probably ran where a commit with one of those messages is paired with a deleted run (StepSecurity, 2026-11-12).