New GhostAction Attack Compromises Hundreds of GitHub Repos to Steal Secrets
GhostAction hit 346 GitHub repositories, including Uber's, with malicious Actions workflows that stole CI secrets.
82
Victim
kitao/pyxel
- Mentions · 7d0
- Mentions · 30d1
- All mentions1
- First seenOct 9, 2026
- Last mentioned16d ago
Timeline
1 articles · newest firstAppears with
- GitGuardianorganization · 1
- GitHuborganization · 1
- GitHub Actionsproduct · 1
- crates.ioproduct · 1
- PyPIproduct · 1
- Docker Hubproduct · 1
- Socketorganization · 1
- npmproduct · 1
- Uberorganization · 1
- Ubervictim · 1
- GitHubvendor · 1
- GhostActionmalware · 1
- GhostActionthreat actor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.