Hackers compromise 4,800 GitHub accounts to steal cloud credentials

The “wfx-loot” campaign used thousands of compromised GitHub accounts to open pull requests and inject malicious code into workflows. Attackers stole secrets from at least 1,835 targets, including GitHub Actions and cloud-service credentials.