GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories
-
The credential-theft campaign tracked as GhostAction has intensified, with activity targeting more than 30,000 repositories belonging to roughly 3,000 users and organizations. According to GitGuardian, the spike in malicious activity was observed on October 8 and 9, 2026.
The surge stemmed from the compromise of approximately 1,900 GitHub accounts. From there, the attackers attempted to extract 3,174 secrets from continuous integration (CI) workflows in public repositories. The campaign highlights the growing risk posed by abused CI pipelines, where stolen credentials can be harvested at scale from exposed repository automation.
Key points:
- Roughly 1,900 GitHub accounts compromised
- Over 30,000 repositories targeted
- About 3,000 users and organizations affected
- 3,174 secrets targeted for extraction from public repository CI
Developers and organizations should review their GitHub account security, audit CI workflow permissions, and rotate any credentials that may have been exposed through repository automation.
Source: The Hacker News
Has your organization reviewed its CI workflow permissions and secret exposure in response to this campaign?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login