wfx-loot campaign hijacks 60k GitHub repos, steals CI secrets

A credential-theft campaign dubbed wfx-loot used thousands of compromised GitHub accounts to plant a CI secret stealer that executed in over 1,800 repositories, targeting up to 60,000 repos. The attack exploits trust in open-source supply chains and CI/CD pipelines, with the full scope of stolen credentials and downstream impact still unclear. This underscores a growing threat to software supply chains, potentially affecting organizations relying on compromised repositories.

AI disclosure: Model-written summary of the source, not a verified fact. Check the sources. How Mosaic works