Ghost Action Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories
Summary: GitGuardian observed a spike in the GhostAction credential-theft campaign on October 8 and 9, 2026, in which about 1,900 compromised GitHub accounts targeted more than 30,000 repositories across 3,000 users and organizations and attempted to extract 3,174 secrets from public repositories' CI. The campaign, first discovered in September 2025, uses stolen Personal Access Tokens or credentials from infostealer logs to push malicious GitHub Actions workflow files disguised as "security-audit.yml" or "github_actions_security.yml", and GitHub began blocking the workflow from running on October 9, 2026, stopping the October 10 and 12 waves from extracting secrets.
Bottom line: A subset of victims in this burst had already been compromised in the September 2025 and August 2026 waves, meaning the attackers are counting on secrets that were never rotated - and the payload's later variants scan git history specifically to pair AWS key IDs with their matching secret access keys.
Read the original at The Hacker News ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026