What Happened
Starting Tuesday, an attacker used stolen credentials for 4,837 GitHub accounts to plant a secret-stealing workflow in repositories those accounts controlled, The Hacker News reports. Aikido Security confirmed the GitHub CI secret stealer ran in at least 1,806 repositories. SafeDep counted 8,093 repositories with malicious commits, 771 of them through npm postinstall hooks.
Each attack opened with a test pull request titled “docs: dependency audit notes” from a branch named wfx-docs, sent to 61,764 repositories. The stealer grabs Actions secrets, GITHUB_TOKEN, OIDC tokens, AI service keys, and credential files for AWS, Azure, GCP, Kubernetes, npm, PyPI, and SSH. It trades OIDC tokens for cloud sessions, creates long-lived AWS IAM keys, and adds Azure federated credentials with the prefix wfx-ci to survive rotation. The attacker reverted most commits within minutes and deleted run logs.
Why This Matters for Canadian Organizations
Canadian fintechs, SaaS firms, and public sector digital teams build and deploy through GitHub Actions every day. A stolen developer account is now enough to empty a pipeline of its cloud keys. Fast reverts and deleted logs mean many victims see nothing in their commit history today.
The cloud persistence is the real danger. Rotating a GitHub token does nothing if the attacker already holds an IAM key or an Entra ID federated credential. OSFI B-13 expects federally regulated financial institutions to manage third-party and software supply chain risk. Exposed customer data from a compromised cloud account also triggers PIPEDA breach reporting.
What to Do
Search your organization for the wfx-docs branch and the commits “ci: refresh build cache” and “chore: add ci helper”. Treat every secret and cloud role an affected repository reads as compromised and rotate it. Audit Entra ID for federated credentials named with the wfx-ci prefix and review CloudTrail for new IAM keys and changed trust policies. Enforce 2FA, restrict GITHUB_TOKEN permissions, and require approval for workflow changes. Follow our TechTalk coverage and latest news for updates.
