thehackernews.com
Oct 15, 2026
GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories
AI-summarised brief · reviewed before publication
GhostAction, a supply‑chain attack campaign, intensified on October 8‑9, 2026, compromising about 1,900 GitHub accounts and targeting over 30,000 repositories. Researchers Gaetan Ferry and Guillaume Valadon reported that attackers injected malicious GitHub Actions workflows into public CI pipelines, aiming to exfiltrate 3,174 secrets, including cloud credentials, package registry tokens, and AI provider keys. The new wave added a git‑history secret‑scanning feature, but GitHub’s safeguards halted further secret extraction after October 9.
💡 Why It Matters
- · The attack exposes how compromised developer accounts can weaponize CI/CD pipelines, turning trusted automation into a mass‑scale data exfiltration tool.
- · It underscores the urgency for stricter access controls and real‑time monitoring of workflow changes in open‑source environments.
