390,000 WordPress accounts stolen from hackers in supply chain attack

Datadog Security Labs uncovered a year-long campaign by actor MUT-1244 that trojanized GitHub proof-of-concept repositories and used phishing to deploy malware which exfiltrated over 390,000 WordPress credentials plus SSH keys, AWS credentials and other secrets from hundreds of machines (including security researchers and threat actors); the attacks leveraged backdoored build files, malicious packages and droppers, and uploaded data to file-sharing services.