Tag
#credentials
WFX Phantom: GitHub Actions Secret Stealer Campaign
A campaign using stolen GitHub tokens pushed the wfx stealer into thousands of repositories, harvesting CI secrets and cloud credentials since November 10.
Nov 12, 2026