Key Notes
- Aikido traced compromised accounts to probes across more than 61,000 repositories, with confirmed credential theft affecting at least 1,800.
- The malware targets cloud credentials and access tokens for AI providers and coding tools.
- Developers can review recent account activity, rotate exposed credentials and reduce the permissions available to automated workflows.
Attackers used 4,837 compromised GitHub accounts in a campaign targeting the credentials that connect software projects to cloud platforms and AI services, according to security company Aikido.
In a November 12 investigation, Aikido reported probe requests across 61,764 repositories. At least 1,800 repositories ran the secret-stealing payload. The larger figure measures the campaign’s reach, rather than confirmed credential theft from every project.
Cloud and AI keys in the crosshairs
The malware searches for AWS, Azure and Google Cloud credentials, alongside tokens for OpenAI, Anthropic’s Claude, Cursor and other AI tools. Those are credentials held in developers’ environments; the report does not establish a breach of the providers’ own systems.
Aikido calls the campaign wfx-loot. Using stolen credentials, attackers inserted malicious code into automated build workflows or installation scripts, then removed changes and deleted run logs. The activity began on November 10.
The researchers found that 92% of the probe pull requests remained open. They interpret that as a sign many maintainers may be unaware. It is not a direct measurement of how many victims noticed the attack.
Why build systems need tight access controls
GitHub Actions runs automated tasks such as testing software and deploying updates. These jobs may need credentials for other services, making their permissions an important boundary between a source repository and the systems it can reach.
GitHub’s security guidance recommends giving workflow credentials the minimum permissions required and using designated reviewers to approve access to protected environment secrets. It also advises auditing actions and how they handle sensitive values.
That matters for AI teams as much as other developers. A model API key or cloud credential can grant access beyond the code itself, depending on its permissions. Reviewing a repository’s files is only one part of understanding what an automated job is authorized to do.
What developers can check
Maintainers can compare their recent repository activity with Aikido’s published indicators, including a wfx-docs branch or a pull request titled docs: dependency audit notes. Aikido says repositories where the payload ran should treat every workflow-accessible secret and cloud role as compromised.
GitHub also provides a personal security log covering the previous 90 days. It records events involving an account and supports filters for the repository, actor, operation and date, helping developers investigate unexpected activity.
For exposed credentials, GitHub advises rotation and removal of secrets that are no longer needed. Teams should also review cloud access permissions, restrict workflow privileges and protect sensitive deployment environments. Those controls help limit what a compromised account or malicious workflow can reach.
Disclaimer: AIstify is an independent media brand owned and operated by NuvexMedia LLC, publishing news, research, and insights on artificial intelligence, emerging technologies, automation, and related industries. NuvexMedia LLC invests in and collaborates with companies across the AI, technology, software, and digital innovation sectors. These relationships do not influence AIstify’s editorial coverage, and the publication maintains full editorial independence to provide accurate, timely, and objective information. © 2026 NuvexMedia LLC. All rights reserved. This content is for informational purposes only and should not be considered legal, tax, investment, financial, or other professional advice.
