Wfx-loot Campaign Hijacks 4,800 GitHub Accounts to Steal Cloud Credentials

A sophisticated supply-chain campaign, dubbed 'wfx-loot', has compromised 4,837 GitHub accounts to probe over 61,000 repositories for write access. Attackers injected a credential-stealing shell script into GitHub Actions workflows, harvesting CI/CD secrets, AWS, Azure, and GCP credentials, OIDC tokens, and developer tool keys from at least 1,835 confirmed victims, including Fortune 100 firms and government entities.