GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories

As cited

Copy frozen at 2026-10-15 11:21 UTC (site build).

threat intel

GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories

The credential-theft campaign GhostAction compromised approximately 1,900 GitHub accounts on October 8 and 9, 2026, according to GitGuardian researchers. The attack targeted over 30,000 repositories across 3,000 users and organizations, attempting to extract 3,174 secrets from public repositories' continuous integration systems.

Why it matters: Developers and organizations using GitHub must audit account access, rotate credentials, and review repository activity for unauthorized changes, as attackers may have extracted secrets that could enable supply chain compromise or lateral movement.

Source published

2026-10-15 08:45 UTC

First seen by Cybersecurity Tracker

2026-10-15 10:02 UTC