The GhostAction credential-theft campaign targeted over 30,000 repositories across 3,000 organizations, compromising 1,900 accounts.
Attackers used stolen Personal Access Tokens to inject malicious CI/CD automation workflows designed to harvest cloud credentials, registry tokens, and API keys.
According to security researchers at GitGuardian, this activity intensified significantly on October 8 and 9, 2026. The attack managed to compromise the accounts of approximately 1.900 users, targeting over 30.000 code repositories across 3.000 users and organizations, while attempting to extract thousands of sensitive data from public projects.
How did the attackers act?
The GhostAction campaign targeted developer infrastructure on GitHub, compromising legitimate accounts to add automated work files that hid malicious code. The perpetrators gained access to the projects using stolen digital keys and login credentials collected from previous leaks.
These files had misleading names, such as security checks, to deny permissions. The ultimate goal of the perpetrators was the mass theft of sensitive data, such as digital keys for online storage services, passwords for software libraries, and login keys for artificial intelligence systems.
READ ALSO
Attack on supermarket refrigeration systems caused millions in damage and fires in Europe
The evolution of the attacks
A new phase of the campaign began to be observed from August 31, 2026. According to experts, this new effort seemed more experimental and manual, with the code constantly evolving so that it could also search the history of code changes for hidden secrets.
Researchers reported that the malicious code was initially pushed to 160 older victims and twenty minutes later to 28.000 new code repositories between October 8 and 9. New waves of the attack were also recorded on October 10 and 12.
The platform's reaction
GitHub began blocking these files from being executed on October 9, 2026, which meant that subsequent waves of the attack were unable to steal data. Some of the users affected by this new wave had also been victims of earlier attacks that had originally begun in September 2025.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)