Executive Summary
Beginning November 10, 2026, a widespread campaign dubbed WFX Phantom targeted over 63,000 GitHub repositories using compromised tokens, including those associated with the Fly.io GitHub App. The threat actor employs a highly automated botnet to probe repositories, inject a malicious 1,500-line shell script into CI workflows, and immediately delete the workflow runs and revert commits to minimize detection. The campaign has evolved to use Telegram as an exfiltration channel, bypassing traditional IP-based blocklists.
The technical chain involves multi-stage credential theft: first, harvesting all GitHub Actions secrets via memory scanning and `${{ toJSON(secrets) }}` dumps; second, escalating privileges through OIDC tokens to compromise AWS, Azure, and GCP environments; and third, establishing persistence via backdoor Azure federated identity credentials and AWS trust policy modifications. This approach ensures that simply rotating GitHub secrets is insufficient for remediation.
This attack is critical due to its scale and success in compromising high-profile repositories like Nextcloud and WebdriverIO. Organizations using GitHub Actions must immediately audit their audit logs for missing run numbers and unauthorized commits from bot accounts, as the actor's cleanup routine effectively blinds standard monitoring tools that do not capture real-time webhook data.