<![CDATA[GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories]]>

<![CDATA[GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories]]>The credential-theft campaign tracked as GhostAction has intensified, with activity targeting more than 30,000 repositories belonging to roughly 3,000 users and organizations. According to GitGuardian, the spike in malicious activity was observed on October 8 and 9, 2026.

The surge stemmed from the compromise of approximately 1,900 GitHub accounts. From there, the attackers attempted to extract 3,174 secrets from continuous integration (CI) workflows in public repositories. The campaign highlights the growing risk posed by abused CI pipelines, where stolen credentials can be harvested at scale from exposed repository automation.

Key points:

Roughly 1,900 GitHub accounts compromised
Over 30,000 repositories targeted
About 3,000 users and organizations affected
3,174 secrets targeted for extraction from public repository CI

Developers and organizations should review their GitHub account security, audit CI workflow permissions, and rotate any credentials that may have been exposed through repository automation.

Source: The Hacker News

Has your organization reviewed its CI workflow permissions and secret exposure in response to this campaign?

]]>https://xploitlk.com/topic/723/ghostaction-compromises-about-1-900-github-accounts-targets-over-30-000-repositoriesRSS for NodeTue, 27 Oct 2026 07:52:01 GMTSat, 17 Oct 2026 22:30:18 GMT60