Supply-Chain Attack Compromises Thousands of GitHub Accounts

A sophisticated supply-chain campaign, named 'wfx-loot', has compromised over 4,800 GitHub accounts, impacting more than 1,800 organizations, including Fortune 100 firms and government entities. Attackers injected credential-stealing scripts into GitHub Actions workflows to harvest CI/CD secrets, AWS, Azure, and GCP credentials, and OIDC tokens, escalating cloud privileges and exfiltrating data.