Hackers Abuse GitHub Actions to Steal SSH Keys, Cloud Credentials and Access Tokens
GhostAction abused GitHub Actions workflows to steal SSH keys and cloud credentials from public repositories.
74
Threat actor
Mini Shai-Hulud
- Mentions · 7d0
- Mentions · 30d0
- All mentions2
- First seenSep 25, 2026
- Last mentionedOct 8, 2026
Timeline
2 articles · newest firstCompromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware
Re-enabled GitHub Actions again executed Mini Shai-Hulud payloads that stole CI/CD credentials.
78
Appears with
- GitHubvendor · 2
- GitHuborganization · 2
- GitHub Actionsproduct · 2
- GitGuardianorganization · 1
- Shai-Huludthreat actor · 1
- Socketorganization · 1
- XMRigmalware · 1
- Mini Shai-Huludmalware · 1
- DevOpsGPTvictim · 1
- GhostActionthreat actor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.