- 12th November 2026
The wfx campaign used 4,837 hijacked GitHub accounts to plant a CI credential stealer in 8,093 repositories. It ran in at least 1,806, took secrets and cloud keys, then deleted itself within minutes. There is no CVE, and AWS and Azure backdoors survive secret rotation.
Claire Harwood


















