As cited
Copy frozen at (site build).
threat intel
New GhostAction Wave Hits Hundreds of Repos, Expanding Beyond CI/CD Secrets to Cloud Credentials
The GhostAction campaign has expanded to target over 500 GitHub accounts and tens of thousands of repositories since October 7, 2026, injecting malicious workflows that steal both GitHub Actions secrets and committed cloud credentials from repository history. The new variant uses git log with full history fetch to extract AWS keys, artificial intelligence (AI) service tokens, and source control credentials in addition to the publishing secrets targeted in earlier waves, exfiltrating data to a hardcoded command and control IP address. Affected repositories include high-profile projects such as Uber's athenadriver and the 18,420-star pyxel, though no malicious package releases have been observed yet.
Why it matters: Maintainers and organization owners must immediately rotate all credentials named in injected workflows, scan full git history for committed secrets, revoke compromised accounts, and audit package release history, because attackers now hold both publishing credentials for supply chain attack and cloud access keys for lateral movement across infrastructure.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
New GhostAction Wave Hits Hundreds of Repos, Expanding Beyond CI/CD Secrets to Cloud Credentials
The GhostAction campaign has expanded to target over 500 GitHub accounts and tens of thousands of repositories since October 7, 2026, injecting malicious workflows that steal both GitHub Actions secrets and committed cloud credentials from repository history. The new variant uses git log with full history fetch to extract AWS keys, artificial intelligence (AI) service tokens, and source control credentials in addition to the publishing secrets targeted in earlier waves, exfiltrating data to a hardcoded command and control IP address. Affected repositories include high-profile projects such as Uber's athenadriver and the 18,420-star pyxel, though no malicious package releases have been observed yet.
Why it matters: Maintainers and organization owners must immediately rotate all credentials named in injected workflows, scan full git history for committed secrets, revoke compromised accounts, and audit package release history, because attackers now hold both publishing credentials for supply chain attack and cloud access keys for lateral movement across infrastructure.
- Source published
- First seen by Cybersecurity Tracker