Blog
wfx-loot turned stolen GitHub tokens into cloud access. Here’s how to spot it.
A secret-stealing script is spreading through GitHub Actions. The attacker used real logins, so the way to catch it is by watching how machine identities behave.
This post builds on research by Oliver Smith at Aikido Security, who discovered and named the wfx-loot campaign. For the full technical analysis and indicators of compromise, read Aikido’s write-up.
How the attack worked
wfx-loot is the name researchers gave to an active attack on GitHub Actions, the automation many teams use to build and deploy their code. Since November 10, an attacker has used 4,837 hijacked GitHub accounts to push a secret-stealing script into GitHub Actions workflows across 61,764 repositories. As of November 12, the script had run in at least 1,835 of them. No vulnerability was exploited. The attacker signed in with stolen GitHub credentials that already had write access.
Once the script ran, it:
- Stole actions secrets, cloud credentials and AI provider keys from the workflow
- Expanded those into AWS and Azure sessions and chained into other IAM roles
- Persisted by creating new long-lived AWS access keys, opening role trust policies to any AWS account, and adding Azure federated credentials so it could get back in after rotation
- Covered its tracks by deleting the workflow run within about a minute
Every step after the initial login relied on a non-human identity (NHI): a CI token, an IAM role, an access key. Those NHIs are where defenders can see the attack.
Start with identity behavior
Stolen credentials pass access checks because they’re valid. What changes is behavior. A CI role that normally reads one secret starts creating access keys and chaining into other roles. A key that only ever ran from a build runner shows up from a new device or country. A workload that never touched a vault starts pulling secrets from it.
That’s the gap SailPoint Agentic Fabric’s non-human identity detection and response (NHIDR) closes. In SailPoint Agentic Fabric's Risk Center, NHIDR learns what each NHI normally does and raises a threat when that changes:
NHIDR in the SailPoint Agentic Fabric Risk Center shows open NHI threats by severity, and where each NHI is being used from, approved or not.
- An AWS role or IAM access key acting outside its baseline, or used from a new device
- Activity from an untrusted location
- A secret fetched by a new workload
- An Azure app signing in to an unusual service
- A dormant credential suddenly reactivated
- Usage that breaks a zero-trust policy, such as a geo allowlist or an action blocklist
Each threat comes with the NHI’s owners, its permissions and what it can reach, so responders know who to call and what’s at risk. Threats map to MITRE ATT&CK T1078.004 (valid cloud accounts) and can open a SOAR incident in the tools your SOC already uses.
For wfx-loot, this matters most after the theft. When the attacker comes back with the keys and roles they planted, those NHIs start behaving in ways they never have before.
Find exposed credentials before an attacker does
wfx-loot began with GitHub credentials that were already exposed. Aikido found heavy overlap with accounts hit in October’s GhostAction campaign, which stole cloud, AI and CI/CD secrets through compromised GitHub workflows. Credentials that leak and never get cleaned up keep getting reused.
SAF finds cleartext secrets exposed in CI/CD, including GitHub Actions workflow logs and Jenkins job logs. For each one it shows:
- Where it appeared: the repository, workflow, job step and log line
- What it is, with related keys paired, such as an AWS access key ID and its secret key
- Whether it’s still valid
- How often the leak recurs
Teams can see which exposures are live and who owns the fix.
Shrink what a stolen token can reach
Across AWS and Microsoft Entra ID, SAF ties every NHI to an owner and flags the hygiene risks that make an attack like this worse: credentials that never expire, haven’t been rotated in years, sit idle, or hold far more access than they use. Short-lived, narrowly scoped credentials leave an attacker less to work with.
If you use GitHub Actions, check now
- Look for pull requests titled “docs: dependency audit notes” and gaps in workflow run numbers since November 10
- Rotate every secret and cloud role the affected workflows could reach
- Review AWS trust policies, IAM access keys and Azure federated credentials created since November 10, since rotation won’t remove them
Aikido’s research has the full indicator list.
See your NHI exposure and threats in SailPoint Agentic Fabric.
