# WFX Phantom: The GitHub Actions Secret Stealer That Deletes Its Tracks

Source: [Step Security Blog](https://www.stepsecurity.io/blog/wfx-phantom-the-github-actions-secret-stealer) · 2026-11-12 · Security
Page: https://themorning.dev/story/wfx-phantom-the-github-actions-secret-stealer-that-deletes-its-tracks-b43e7e514b053be1
Kind: security · Impact: high

## In brief

- An attacker used stolen credentials for 4,837 GitHub accounts to plant a secret stealer in repositories those accounts could write to, according to Aikido Security.
- The payload runs in CI and is built to take secrets and cloud credentials; it has pushed into tens of thousands of repositories since November 10.
- In more than 1,800 repositories the malware ran and shipped GitHub Actions secrets and cloud credentials to the attacker.

## Why it matters

Any repository where the compromised accounts had write access, and where GitHub Actions secrets or cloud credentials are stored, may have leaked those secrets to the attacker.

## What to do

- Check your GitHub repositories for the injected secret stealer payload, as described by Aikido Security and the Help Net Security article
- Rotate GitHub Actions secrets and cloud credentials that may have been exposed in CI runs

## Timeline

- 2026-11-10: Attacker begins pushing the credential-stealing payload into repositories
- 2026-11-12: Aikido Security's findings are reported by The Hacker News and Help Net Security

## Coverage

- [Check your GitHub repos: A secret stealer hit tens of thousands of them](https://www.helpnetsecurity.com/2026/11/12/wfx-loot-github-actions-secret-stealer/) — Help Net Security, 2026-11-12
- [WFX Phantom: The GitHub Actions Secret Stealer That Deletes Its Tracks](https://www.stepsecurity.io/blog/wfx-phantom-the-github-actions-secret-stealer) — Step Security Blog, 2026-11-12
- [Attacker Used 4,837 Hijacked GitHub Accounts to Run a CI Secret Stealer in 1,806+ Repositories](https://thehackernews.com/2026/11/4837-hijacked-github-accounts-ran-ci.html) — The Hacker News, 2026-11-12
- [Compromised GitHub accounts push CI secret stealer to tens of thousands of repositories](https://www.aikido.dev/blog/compromised-github-accounts-push-ci-secret-stealer-to-tens-of-thousands-of-repositories) — Aikido Security's Blog, 2026-11-12

Tags: github, supply-chain, secrets, ci-cd, credential-theft, github-actions

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev