GhostAction variant steals secrets via workflows in tens of thousands of GitHub repos
Accounts henrywoo and kitao added the workflow on October 8; it exfiltrates secrets over HTTP and scans Git history.
Stories per day · 30 days
3 RSS
Relatedsupply-chain14github11credential-theft7ghostaction7gheist6secrets4ci-cd3outage3pypi3stolen-tokens3webhooks3aws2cicd2github-pages2secret-theft2actions-checkout1ai-coding1cloud-credentials1
37 stories, newest first · one card per story
Stories tagged #github-actions
GitHub mitigates Actions, Pages and Webhooks degradation
Root-cause investigation continues after errors also hit code search and live updates.
GhostAction GitHub campaign slows after hitting tens of thousands of repos
GitGuardian says the operator pushed 72,000 commits to 23,000 public repositories from October 13 to 21.
5
Gheist harvests secrets through malicious GitHub Actions workflows
Wiz tracked more than 13,500 malicious branches on over 850 accounts since September 15, including private enterprise repositories.
2
Gheist uses stolen GitHub tokens to leak private repository secrets
Wiz recovered over 13,500 planted branches from 850-plus accounts; GitHub’s public-repo hold does not cover private repos.
1
Gheist uses stolen GitHub tokens to harvest cloud secrets
Wiz counts more than 13,500 malicious branches on over 850 accounts, still active as of October 24.
Gheist used stolen GitHub tokens to steal secrets from 850 accounts
Workflows on more than 13,500 branches logged secrets; public runs were held, while private and Enterprise Server runs completed.
1
GitHub Actions pwn-request fixes still leave checkout gaps
Old actions/checkout SHA pins and triggers such as issue_comment can still run fork code with secrets.
1
Gheist uses stolen GitHub tokens to leak private repository secrets
Wiz found over 13,500 planted branches from more than 850 accounts; GitHub held public runs but not private ones.
1
Gheist abuses stolen GitHub tokens to dump repository secrets
Wiz found more than 13,500 planted branches on over 850 accounts; public runs are held, but private and enterprise repos still execute.
2
LiteLLM GitHub secrets taken 11 days before malicious package release
October 10 and 12 workflows posted CI secrets to webhook.site; a key committed May 27 was never revoked.
2
GitHub delays pull requests, webhooks, and Actions
GitHub says event-streaming hotspots are still slowing pull request updates, webhook deliveries, and audit log events.
GhostAction workflows in 790 GitHub repos hunt cloud and AI keys
OpenSourceMalware's count through October 9 is validated public repos, not proof that every one leaked secrets.
3
GhostAction plants malicious workflows in 790 GitHub repositories
October payloads mine full Git history for cloud and AI keys and post them over HTTP to 193.32.204.199.
5
GitHub Actions, Pages, and Webhooks hit by degraded availability
GitHub said customers may see delays in workflow runs, site builds, and webhook delivery while it investigates.
GhostAction plants font-disguised stealer in 94 GitHub repositories
Phishing via my-github.com steals GitHub passwords, 2FA, and OAuth tokens, then a VS Code task runs a credential stealer.
6
12 Best CI/CD Pipeline Security Tools Compared (2026): Features & Pricing
A 2026 comparison ranks native and dedicated tools for securing CI/CD pipelines.
GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories
GhostAction compromised about 1,900 GitHub accounts and pushed malicious workflows to steal CI secrets from tens of thousands of repositories.
10
AI-generated changes create review bottlenecks in software delivery
JetBrains finds most DevOps teams run CI/CD, while AI-generated changes slow code reviews.
GhostAction Hackers Compromise 500+ GitHub Accounts to Steal Cloud and AI API Credentials
GhostAction compromised 500-plus GitHub accounts and planted workflows that steal cloud and AI API credentials.
8
Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories
GhostAction compromised maintainer accounts to plant credential-stealing GitHub Actions workflows in tens of thousands of repositories.
12
New GhostAction Attack Compromises Hundreds of GitHub Repos to Steal Secrets
GhostAction hit 346 GitHub repositories, including Uber's, with malicious Actions workflows that stole CI secrets.
8
In Other News: AI Used in Korean Bank Breaches, Poem-Guided Botnet, Empire Admin Gets 40 Years
SecurityWeek roundup: PoeLLM botnet resolves C&C via GitHub poem, GhostAction hit 772 repos, CrowdStrike links Chinese actor to Korean bank breaches.
5
GhostAction Supply Chain Campaign Uses Malicious GitHub Actions to Steal CI/CD Credentials
GhostAction hit 772 GitHub repositories with malicious Actions workflows that stole CI/CD secrets.
3