The active wfx-loot campaign used compromised developer and bot identities to insert credential-stealing code into trusted build workflows, erase execution records and establish cloud access that can survive ordinary secret rotation.
What changed
Treat any wfx probe generated by an internal identity as confirmed credential compromise. Where the payload or a deleted workflow run is found, assume every secret, runtime token and cloud role available to that workflow was exposed.
Public record through 2026-11-13. Source references count citations across published briefings, including repeated sources. Explore the record and its limits →
What We Publish / What We Sell
D
Free · Public
The Daily
Five evidence-backed selections for security leaders, every weekday.
Security.io editorial scores from 0 to 100 reflect observed scale, active credential theft, rotation-resistant cloud persistence and remediation complexity. They are not vendor severity scores. Exposure: 98. Urgency: 97. Business consequence: 95. Focus the chart and use the up and down arrow keys for detail. Source: Security.io editorial assessment using Aikido Security, StepSecurity, GitHub and independent reporting.