What happened. Starting around 12:45 UTC on Nov 10, an attacker began using stolen GitHub tokens to push a credential stealer, which names itself wfx, into every repository those tokens could write to. Aikido Security, which calls the operation wfx-loot, counts 4,837 compromised accounts that opened probe pull requests in 61,764 repositories, and at least 1,835 repositories where the payload ran and sent credentials out. Aikido says compromised accounts include users at Fortune 100 companies and people with write access to Nextcloud, WebdriverIO, the US General Services Administration and France's beta.gouv.fr. It stresses that access does not mean the stealer ran in those organizations' repos. StepSecurity notes there is no bug in GitHub Actions here; the attacker is simply using valid tokens.
How it works. First comes a harmless pull request titled docs: dependency audit notes from a wfx-docs branch. It only tests whether the token can write. Then the attacker pushes about 1,500 lines of shell script one of three ways: injected into an existing workflow (ci: refresh build cache), hooked to npm install through a hidden .ci-xxxxxx.sh file (chore: add ci helper), or as a new workflow on a throwaway chore/ branch. The script collects Actions secrets, the job's tokens, runner memory, cloud credential files and AI provider keys, and tries to stay in AWS and Azure after you rotate. Within about a minute it reverts the commit and deletes the workflow run and its logs, so a skipped run number is often the only trace.
The Fly.io angle. StepSecurity traced 173 probe pull requests from 19 accounts to tokens GitHub issued to the Fly.io GitHub App, which acts as the user once they connect GitHub to Fly.io. StepSecurity says it does not know how those tokens were obtained and has no evidence Fly.io itself was breached; most of the campaign uses other credentials such as personal access tokens.
Why an enterprise should care. CI runners hold the keys to production: cloud roles, package publishing tokens and deploy secrets. Aikido says at least 50 compromised users publish packages to npm, Go, Packagist, PyPI or crates, and the payload has already slipped into at least one Packagist and one Go package through automated publishing.
Do now. Search every repo your people can write to for a wfx-docs branch, a docs: dependency audit notes PR, or the three commit messages above on or after Nov 10. Look for gaps in Actions run numbers right after those commits. If you find one, treat every secret and cloud role that workflow could reach as stolen: rotate them, revoke the account's tokens and connected GitHub App grants, and hunt for new IAM users, keys or role trusts in AWS and Azure.