TI Mindmap HUB
Threat Intelligence Report

wfx: GitHub Actions Credential Stealer Hits 8,000 Repos

📅 November 12, 2026 📰 safedep.io 🔍 0 CVE(s) referenced

The active “wfx” campaign used stolen GitHub tokens to inject a credential stealer into over 8,000 repositories, exfiltrating CI and cloud secrets, planting persistent AWS and Azure backdoors, and then reverting commits to conceal the compromise.

vendor

Sign in to access the full report including:
detailed analysis, IOCs, MITRE ATT&CK mapping, and STIX bundle.

🔐 Sign In to Read Full Report

You'll need to accept our Terms of Service to access the platform.

📊 Visual Mindmap
🎯 IOC Extraction
⚔️ MITRE ATT&CK TTPs
📦 STIX 2.1 Bundle