News Application Security
wfx-loot campaign turns hijacked GitHub accounts into a CI secret-stealing engine
An attacker used thousands of stolen GitHub credentials to push a shell script into Actions workflows, CI scripts and npm hooks. Aikido Security says it ran and exfiltrated secrets in more than 1,800 repositories, and the campaign is still active.
Jay B.