According to The Hacker News, the credential-theft campaign known as GhostAction has significantly increased its activity, impacting more than 30,000 repositories across 3,000 users and organizations on GitHub.
The surge, observed on Oct. 8 and 9, 2026, resulted from compromising approximately 1,900 GitHub accounts. Attackers attempted to extract over 3,174 secrets from public repositories' CI/CD workflows. GhostAction, a supply chain attack, involves threat actors hijacking developer accounts to inject malicious GitHub Actions. They gain write access using stolen Personal Access Tokens or infostealer credentials, then deploy deceptive workflow files like "security-audit.yml." The primary objective is stealing CI/CD secrets, cloud credentials, package registry tokens, and AI provider API keys. A recent wave, starting Aug. 31, 2026, showed evolving payloads, including secret-scanning features for AWS keys, GitHub/GitLab tokens, and AI secrets. While GitHub began blocking malicious workflows on Oct. 9, some victims were previously compromised, indicating a reliance on unrotated secrets.
Source: The Hacker News
