GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories
By [email protected] (The Hacker News)
AI Summary
The GhostAction credential-theft campaign spiked on October 8–9, 2026, compromising approximately 1,900 GitHub accounts and attempting to extract 3,174 secrets from CI configurations across more than 30,000 repositories belonging to 3,000 users and organizations, according to GitGuardian researchers. The campaign specifically targets CI pipeline secrets exposed in public repository configurations, giving attackers access to credentials for downstream systems including cloud providers and internal services. Affected organizations should rotate all CI secrets and audit repository access logs for the October 8–9 window.
Relevance score: 74.0/100
Expert cybersecurity solutions to safeguard your organization from evolving threats.
Get Protected →