Threats · 3h ago
GitGuardian saw GhostAction spike on Oct. 8-9, 2026, using about 1,900 compromised GitHub accounts to target more than 30,000 repositories and attempt to extract 3,174 CI secrets. GitHub started blocking the malicious workflow from running on Oct. 9.
The campaign works by taking over legitimate maintainer accounts and pushing a fake workflow that looks like routine security automation. Because it runs through normal GitHub Actions, it can read secrets the repository already trusts during builds, including cloud, package, and API credentials.
For teams that rely on GitHub Actions and stored secrets, the exposure is not limited to the bad workflow file itself: reused or unrotated credentials can keep a previously hit repository useful to attackers months later. GitHub’s block stopped later runs, but it does not erase secrets already copied out or reused elsewhere.
1 source covering this story
GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories
GhostAction targeted over 30,000 GitHub repositories using about 1,900 compromised accounts and tried to extract 3,174 secrets.
Part of the PlainSec briefing for 2026-10-15