Malware
wfx
- First Reported
- Nov 12, 2026
- Latest Reported
- Nov 12, 2026
Reported Context (2)
- We're tracking this campaign as wfx-loot based on the threat actor's name for the malware and the term used for stolen secrets. wfx-loot Campaign Uses Stolen GitHub Credentials to Steal CI Secrets
- tokens to push a CI secret stealer into repositories those tokens can write to. The stealer names itself wfx. It collects every GitHub Actions secret, the runner's memory, and cloud credentials, and it tries to stay WFX GitHub Actions Stealer Uses Stolen Tokens to Harvest Secrets
MITRE ATT&CK (17)
Vendors (6)
Products (9)
Tools (1)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.