secrets-exfiltration

wfx-loot: GitHub Actions Secret Stealer

A stolen-credential campaign probed 61,764 GitHub repositories and planted a CI secret stealer in roughly 8,000. Here is what ran, what did not, and what to rotate now.