Posts tagged with "Incident Response"

The wfx campaign used 4,837 hijacked GitHub accounts to probe 61,764 repositories, ran a credential stealer in at least 1,806 of them, and planted federated identity credentials on Entra app registrations that survive every secret rotation. Enumerate every federated trust across app registrations and managed identities, hunt the deleted workflow runs, rotate in the right order, and scope GitHub OIDC subjects to protected environments.