HighSupply chainActive
"wfx-loot" campaign abuses 4,800+ hijacked GitHub accounts to plant CI secret stealer; credentials exfiltrated from at least 1,835 repositories
Aikido says that since November 10 an attacker has used stolen GitHub credentials across 4,837 compromised accounts to open probe pull requests in 61,764 repositories, and at least 1,835 repositories ran the payload and had GitHub Actions secrets and cloud credentials stolen .