wfx-loot: GitHub Actions Secret Stealer in 1,806 Repos

Since 2026-11-10, an attacker has used stolen credentials for 4,837 GitHub accounts to push a credential stealer into repositories those accounts can write to. Aikido Security named the campaign wfx-l