StepSecurity uncovers GitHub Actions secret stealing campaign

StepSecurity researchers report that starting on 10 November 2026, a coordinated botnet of compromised GitHub accounts began using stolen tokens to push a CI secret stealer, named wfx, into every repository those tokens could write to. The attack unfurled through seemingly harmless pull requests before delivering a malicious shell script to default branches, with the operators reverting the commit and deleting the workflow run within minutes.

By 12 November 2026, GitHub search estimated more than 62,000 probe pull requests, with around 90% still open, and new ones appearing rapidly. The analysis examined over 80 attacker commits, including activity in nextcloud/docker, webdriverio/webdriverio, juejin-cn/repo-data and ipfs-shipyard/js-ipld-fixtures.

Notably, two techniques emerged: a switch to Telegram for data exfiltration from about 05:30 UTC on 12 November, and a fourth hiding place where the stealer is pasted into ordinary shell scripts that CI already runs, such as update[.]sh or tests/retry_env.sh.

The attack operates without exploiting a GitHub Actions bug. For each writable repository, the attacker uses valid tokens to perform three steps: probe via a harmless pull request titled docs: dependency audit notes; payload delivery by appending the wfx shell script to existing workflows or shell scripts; and cleanup by reverting the commit and deleting the workflow run, often leaving only minimal traces.

Evidence includes missing run numbers in the Actions tab, memory reads from Runner[.]Worker, and exfiltration to two collection servers (194.150.166[.]244:8080/exfil and 18.143.168[.]96:8080/exfil), followed by Telegram uploads to api.telegram[.]org. The article details several persistence methods, including forged checks, an ever-open AWS role, and an Azure federated identity credential, which together enable continued access even after token rotation.

It also outlines indicators of compromise and recommended investigative steps, such as tracing the compromised accounts, inspecting branches and commits, and reviewing token ownership and cloud credentials.