Stolen GitHub accounts turn workflows into credential thieves The wfx-loot campaign probes repositories, runs secret-stealing workflows and deletes logs. Check cloud trust as well as tokens.