helpnetsecurity.com/2026/11/12/wfx-loot-github-actions-secret-stealer Check your GitHub repos: A secret stealer hit tens of thousands of them
Aikido reports that stolen GitHub credentials were used to inject a credential-stealing payload into tens of thousands of repositories beginning November 10. In over 1,800 of them, the code ran and sent cloud credentials and GitHub Actions secrets to the attacker, and Aikido named the campaign wfx-loot.
