GhostAction Attack Targets 30,000+ GitHub Repositories
Date Observed: October 8-16, 2026 (latest two waves; campaign remains active)Ecosystem: GitHub, GitHub Actions, and developer workstationsTargets: Open-source maintainers; CI/CD secrets; cloud, package-publishing, and AI API credentialsAttack Type: Compromised maintainer accounts, malicious GitHub Actions workflow injection, credential theft, and developer-workstation persistenceImpact: More than 30,000 repositories targeted; about 1,900 GitHub user accounts compromised; 3,174 CI secrets […]