GhostAction GitHub campaign slows after hitting tens of thousands of repos
GitGuardian says the operator pushed 72,000 commits to 23,000 public repositories from October 13 to 21.
68
Organization
GitGuardian
- Mentions · 7d2
- Mentions · 30d12
- All mentions19
- First seenAug 31, 2026
- Last mentioned2d ago
Timeline
19 articles · newest firstGheist uses stolen GitHub tokens to leak private repository secrets
Wiz found over 13,500 planted branches from more than 850 accounts; GitHub held public runs but not private ones.
76
GhostAction workflows in 790 GitHub repos hunt cloud and AI keys
OpenSourceMalware's count through October 9 is validated public repos, not proof that every one leaked secrets.
74
GhostAction plants malicious workflows in 790 GitHub repositories
October payloads mine full Git history for cloud and AI keys and post them over HTTP to 193.32.204.199.
76
GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories
GhostAction compromised about 1,900 GitHub accounts and pushed malicious workflows to steal CI secrets from tens of thousands of repositories.
82
10 Best Secrets Detection Tools Compared (2026): Features & Pricing
A 2026 comparison ranks ten secrets-detection tools, from GitGuardian and TruffleHog to free GitHub and Gitleaks scanning.
18
Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories
GhostAction compromised maintainer accounts to plant credential-stealing GitHub Actions workflows in tens of thousands of repositories.
82
New GhostAction Attack Compromises Hundreds of GitHub Repos to Steal Secrets
GhostAction hit 346 GitHub repositories, including Uber's, with malicious Actions workflows that stole CI secrets.
82
In Other News: AI Used in Korean Bank Breaches, Poem-Guided Botnet, Empire Admin Gets 40 Years
SecurityWeek roundup: PoeLLM botnet resolves C&C via GitHub poem, GhostAction hit 772 repos, CrowdStrike links Chinese actor to Korean bank breaches.
58
GhostAction Supply Chain Campaign Uses Malicious GitHub Actions to Steal CI/CD Credentials
GhostAction hit 772 GitHub repositories with malicious Actions workflows that stole CI/CD secrets.
78
Hackers Abuse GitHub Actions to Steal SSH Keys, Cloud Credentials and Access Tokens
GhostAction abused GitHub Actions workflows to steal SSH keys and cloud credentials from public repositories.
74
The Credential Layer Is Expanding Faster Than Security Teams Can See It
GitGuardian says secrets sprawl is outpacing visibility as commits, agents, and leaked AI credentials multiply.
36
Secrets Sprawl Is an Identity Problem That AI Just Made Impossible to Ignore
GitGuardian finds AI-assisted commits leak secrets about twice as often as human-written code.
58
GitHub App keys can still enable takeovers long after they are forgotten
GitGuardian found 474 still-valid leaked GitHub App keys that can enable repository access and organization takeovers.
73
Hundreds of Leaked GitHub App Keys Still Authenticate
GitGuardian found 474 leaked GitHub App private keys still authenticate, some with organization admin rights.
76
Hackers Exploit TanStack Supply Chain Attack to Steal 170 Private CrowdSec Repositories
CrowdSec says TeamPCP cloned about 170 repositories using a GitHub token stolen in the TanStack npm compromise.
73
The AI Supply Chain Has a Security Problem, and Much of It Is Sitting on the Open Internet
Researchers counted 36,769 publicly reachable self-hosted AI endpoints, only about 2% behind HTTP authentication, exposing Ollama, vLLM, and Flowise to abuse.
45
Shai-Hulud's Reach Just Grew to 469 Credential Locations. Here's What That Means
GitGuardian found the Shai-Hulud infostealer worm now scans 469 credential locations, including CI/CD and AI tool configs, expanding supply-chain risk.
55
Debian developers rejected an LLM ban and left disclosure voluntary
Debian developers voted to encourage voluntary disclosure of AI assistance in contributions rather than banning or mandating labeling of LLM-generated code.
30
Related CVEs
by mentions- CVE-2026-4093312%9.9Flowise: Due to unsafe serialization of stdio commands in the MCP adapter, an authenticated attacker can add an MCP stdio server with an…
- CVE-2026-47483<1%8.2NVIDIA DCGM Exporter for all platforms contains a vulnerability in the /debug/pprof endpoints, where an attacker could cause uncontrolled resource consumption…
Appears with
- GitHubvendor · 13
- GitHub Actionsproduct · 12
- GitHuborganization · 8
- GhostActionthreat actor · 7
- GitGuardianvendor · 5
- Socketorganization · 5
- StepSecurityorganization · 4
- npmproduct · 3
- GhostActionmalware · 3
- Ubervictim · 3
- Sierra Nevada Corporationorganization · 2
- BuildBuddyorganization · 2
- Civicavictim · 2
- Centers for Disease Control and Preventionvictim · 2
- Sierra Nevada Corporationvictim · 2
- BuildBuddyvictim · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.