GhostAction GitHub campaign slows after hitting tens of thousands of repos
Original title: GhostAction Hacking Wave Fizzles, But Attackers Lurk on in GitHub
GitGuardian says the operator pushed 72,000 commits to 23,000 public repositories from October 13 to 21.
GhostAction compromises GitHub developer accounts and injects malicious Actions workflows that steal repository secrets, package publishing tokens, personal access tokens, and credentials in source code. An October 8–12 wave pushed security-audit.yml into roughly 30,000 repositories. GitGuardian later described a larger October 13–21 push, while Dark Reading says that latest wave has largely failed.
Unconfirmed: Commit and repository counts are GitGuardian’s; the article says the latest wave largely failed.
- About 8,000 of the 23,000 repositories in the later wave were new targets.
- Payloads differ depending on which runner executes the repository workflows.
- The campaign was first documented last year and is still being deployed.
Impact: Stolen repository secrets, tokens, and embedded credentials
- 1.Search repositories for the injected security-audit.yml GitHub Actions workflow.
- Products
- GitHub Actions
- Threat actors
- GhostAction
- Organizations
- GitHubGitGuardian
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 1d1c29eff49426577dcf3e84cf3b98ff | k-openclaw-cline-users#recipe=similar-items&sourcecontentid=1d1c29eff49426577dcf3e84cf3b98ff) Supply Chain Attack Secretly Installs OpenClaw for Cline |
| md5 | 1e51d280261e34e0cc1db58fc4422dce | tepad-updates-6-months#recipe=similar-items&sourcecontentid=1e51d280261e34e0cc1db58fc4422dce) Chinese Hackers Hijack Notepad++ Updates for 6 Months by |
| md5 | 208b9846191967c692e5c2bf1e972959 | ay-light-patch-tuesday#recipe=similar-items&sourcecontentid=208b9846191967c692e5c2bf1e972959) Microsoft Fixes Exploited Zero Day in Light Patch Tuesday |
| md5 | 5f19c8eeeb93473c11fd921316903dea | iden-era-sbom-guidance#recipe=similar-items&sourcecontentid=5f19c8eeeb93473c11fd921316903dea) Trump Administration Rescinds Biden-Era Software Guidance |
From the original article
8 min read at darkreading.com
The supply chain attack campaign's shift toward developer endpoints and cloud access signals what could be next for the cybercrime outfit.
By Alexander Culafi · darkreading.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.