Hackers Use Fake PoCs on GitHub to Steal WordPress Credentials, AWS Keys

### Executive Summary Datadog Security Labs discovered a year-long campaign by actor MUT-1244 that lured security researchers and practitioners with trojanized proof-of-concept code on GitHub and targeted academics via phishing; attackers deployed droppers, backdoored configs, malicious PDFs and npm packages to steal sensitive data, exfiltrating over 390,000 WordPress credentials plus AWS keys, SSH private keys, and command histories.