Security researchers have uncovered an ongoing, large-scale software supply chain campaign dubbed “wfx-loot” that has compromised 4,837 GitHub accounts to steal sensitive cloud credentials. Threat actors utilized valid developer and bot tokens—some harvested from publicly exposed configuration files—to open more than 61,000 probe pull requests across public and private repositories. By injecting malicious code into GitHub Actions workflows and npm postinstall hooks, the attackers exfiltrated API keys, AWS secrets, and deployment tokens across thousands of active development pipelines.
About the Author
