Ghost Action Attackers Target Nearly 23,000 GitHub Repos with Credential-Stealing Malware
Summary: The GhostAction operator pushed more than 72,000 commits to 22,964 public GitHub repositories between October 13 and 21, 2026, with 7,989 of those repositories being new victims, according to GitGuardian. After GitHub began blocking the malicious workflow on October 9, the actor added a second stage that persists on developer machines through a hidden VS Code task and a cron job running attacker code every five minutes, and by October 26 the campaign had grown to 1,230 repositories owned by 391 accounts carrying the fake font file and hidden task.
Why it matters: GitGuardian found that 1,382 of the 1,792 compromised accounts had already been used on October 8, meaning the same stolen tokens kept working through the entire campaign - the block on the workflow did not invalidate the credentials behind it.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026