Executive Summary
Starting November 10, 2026, a large-scale supply chain attack has targeted over 8,000 GitHub repositories using compromised developer accounts. The primary goal is the exfiltration of sensitive CI/CD secrets, including cloud provider credentials (AWS, Azure, GCP), package registry tokens, and AI service API keys. The malware, identified as 'wfx', is injected via malicious pull requests and commits that are quickly reverted to evade detection.
The attack chain involves an initial 'probe' pull request to test write access, followed by the deployment of a 1,500-line shell script through workflow injection, install hooks, or throwaway branches. Once executed within GitHub Actions, the stealer escalates privileges by minting OIDC tokens for cloud environments and establishing persistence by modifying IAM policies or adding federated credentials.
Impact is critical due to the scale of compromised accounts and the high-value nature of the stolen secrets. Organizations are advised to hunt for specific commit patterns and audit cloud configurations for new, unauthorized access keys or modified trust policies created after the campaign start date.