GhostAction Hackers Compromise 500+ GitHub Accounts to Steal Cloud and AI API Credentials
GhostAction compromised 500-plus GitHub accounts and planted workflows that steal cloud and AI API credentials.
80
Vendor
SendGrid
- Mentions · 7d0
- Mentions · 30d3
- All mentions4
- First seenAug 17, 2026
- Last mentioned21d ago
Timeline
4 articles · newest firstTIKTOUK WordPress Toolkit Could Enable AWS, SMTP and API Credential Theft Attacks
TIKTOUK harvests exposed WordPress files and JavaScript to steal SMTP, AWS, and API credentials.
64
Researchers Find 543,699 Active Credentials Leaked in Public GitHub Repos
Truffle Security verified 543,699 credentials still active after exposure in public GitHub repositories.
78
TrickBot Campaign Uses Fake Payroll Emails to Conduct Phishing Attacks
TrickBot phishing campaign used SendGrid, fake Google Docs, and Drive-hosted downloaders disguised as Word files to deliver a credential-stealing payload.
50
Related CVEs
by mentions- CVE-2026-6303011%9.8WordPress Core Route Confusion (wp2shell) Enables SQL Injection to RCE
- CVE-2026-601375%5.9WordPress Core SQL Injection via WP_Query author__not_in (CVE-2026-60137)
Appears with
- Amazon Web Servicesvendor · 2
- GitHuborganization · 2
- Googlevendor · 2
- GitHubvendor · 2
- Anthropicvendor · 2
- SendGridproduct · 1
- The Stack v3product · 1
- GitHub Actionsproduct · 1
- Google Driveproduct · 1
- Easy WP SMTPproduct · 1
- PERISMOUNT LIMITEDorganization · 1
- npmorganization · 1
- Amazon Bedrockproduct · 1
- OpenAIvendor · 1
- Hugging Faceorganization · 1
- MongoDBproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.