According to Aikido Security, in at least 1,806 of them the payload actually ran and shipped secrets and cloud keys to attacker-controlled servers.

The attacker then reverted each change within minutes and deleted the workflow runs and their logs, leaving a missing run number as often the only trace.

The attackers walked in through the front door with valid developer credentials — no typosquatting or dependency confusion — and the payload sat on main branches for only seconds between two ordinary-looking commits.

Pasquale Pillitteri reports the wfx-loot script even forged passing check results for branch protection rules, and that it adds Azure federated credentials with a wfx-ci- prefix so attackers keep access even after all secrets are rotated.

About 92% of probe pull requests in repositories the accounts did not own were still open when researchers checked, meaning most owners had not noticed anything.

Researchers flagged specific indicators: branches named wfx-docs, chore/[a-z0-9]{8} and ci-check-[0-9]{4}, commits like "ci: refresh build cache" and "chore: add ci helper" (which adds an npm postinstall hook), and exfiltration to 194.150.166[.]244:8080 and 18.143.168[.]96:8080.

The Hacker News reports SafeDep counted 8,093 repositories receiving malicious commits, and that in a sample of 200 payload commits about a fifth sent data to a Telegram channel rather than HTTP endpoints.

The stealer harvests Actions secrets, the workflow GITHUB_TOKEN, OIDC tokens, credential files for AWS, Azure, GCP, Kubernetes, npm, PyPI and SSH, plus AI service keys, and it can exchange OIDC tokens for real cloud sessions and create long-lived AWS access keys.

At least 50 compromised users publish packages on npm, Go, Packagist, PyPI or crates.

Cyber Press reports the payload reached one Packagist package (digitalelvis/neuronai-studio 3.14.3) and one Go module through automated publishing triggers, though the attacker appears more interested in CI secrets than spreading through packages.

Anyone who opened one of the attacker's probe pull requests should treat that account as compromised even if the stealer never ran.

Endor Labs' guidance, as summarized by Pasquale Pillitteri, calls for revoking sessions, tokens, SSH keys and OAuth grants, rotating every repository and organization secret, checking for Azure wfx-ci-* federated credentials and AWS trust policies opened to any account, and closing probe pull requests.

Longer term, hardening means code owner approval for workflow changes, read-only GITHUB_TOKEN, and OIDC trust tied to specific repositories and branches.

Aikido does not attribute November to October's GhostAction actor, but accounts hit in October were about 1,000 times more likely to be used this week.