Stolen GitHub tokens push CI secret-stealer to 60,000 repos
wfx-loot used ~4,800 compromised GitHub accounts to probe 61,764 repositories and run a CI secret-stealer in 1,800+ of them — no GitHub Actions bug, just valid stolen tokens.
wfx-loot used ~4,800 compromised GitHub accounts to probe 61,764 repositories and run a CI secret-stealer in 1,800+ of them — no GitHub Actions bug, just valid stolen tokens.