A credential-theft campaign called GhostAction has escalated significantly, compromising approximately 1,900 GitHub accounts and targeting over 30,000 repositories across thousands of users and organizations. Security researchers at GitGuardian detected the spike on October 8 and 9, 2026, during which attackers attempted to extract more than 3,100 secrets from public repositories’ continuous integration systems. The campaign represents a supply chain attack where threat actors inject malicious GitHub Actions workflows into software repositories after gaining write access through stolen credentials.
GhostAction operators seek to steal sensitive information including CI/CD secrets, cloud credentials, package registry tokens, and artificial intelligence provider API keys. The attack evolved through multiple payload versions, with later iterations adding git history scanning capabilities to detect various types of secrets such as AWS keys and cloud API credentials. GitHub began blocking the malicious workflows starting October 9, preventing subsequent attack waves from successfully extracting secrets. Notably, some victims had been compromised in previous GhostAction campaigns, suggesting attackers were attempting to exploit unrotated credentials.
Source: Read the full story at The Hacker News
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
