A threat actor used 4,837 stolen GitHub accounts to probe 61,764 repositories for write access, starting on November 10. In at least 1,835 of those repositories, a credential-stealing script ran and sent secrets to the attacker. Application security company Aikido Security first reported the wfx-loot campaign and published the figures. Many owners have likely not…

Continue Reading