Since November 10, 2026, pull requests titled docs: dependency audit notes, from a branch named wfx-docs, have been opened by the tens of thousands in public GitHub repositories. According to public reporting, they are opened with stolen GitHub tokens to…

The post wfx CI secret stealer: How to check if a stolen GitHub token probed your repositories appeared first on Security Boulevard.

Nir (Amara) Nave

Source: Security Boulevard
Source Link: https://securityboulevard.com/2026/11/wfx-ci-secret-stealer-how-to-check-if-a-stolen-github-token-probed-your-repositories/