Attacker Targets 60,000 GitHub Repositories in Credential Theft Campaign

Using thousands of hijacked accounts, the wfx-loot campaign planted a CI secret stealer that ran in over 1,800 GitHub repositories.

Source: SecurityWeek · 2026-11-12