GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories

The GhostAction campaign, a supply chain attack targeting GitHub accounts, has compromised approximately 1,900 users and targeted over 30,000 repositories to steal CI/CD secrets, cloud credentials, and AI API keys. Attackers use stolen Personal Access Tokens (PATs) or credentials from infostealer logs to gain write access and inject malicious GitHub Actions workflows with deceptive names like 'security-audit.yml'. The latest wave, observed starting August 31, 2026, features evolving payloads that include git history secret-scanning capabilities to extract AWS keys and associated secrets, with GitHub blocking execution starting October 9. Some victims were re-compromised, suggesting unrotated secrets remain exploitable.

AI-extracted · verify before operational use