GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories
GhostAction campaign compromises 1,900 GitHub accounts, targets 30,000+ repositories.
Run GitHub?
Get an email when a reviewed story names GitHub, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
The credential-theft campaign dubbed GhostAction has significantly increased its activity, impacting over 30,000 repositories belonging to 3,000 users and organizations. This surge, observed on October 8-9, 2026, resulted from the compromise of approximately 1,900 GitHub accounts. Researchers noted attempts to extract 3,174 secrets from public repositories' CI/CD pipelines.
The lesson from this incident
Full lessonThe GhostAction campaign exploited compromised GitHub credentials to gain unauthorized access to thousands of repositories, targeting secrets stored within CI/CD pipeline configurations. This incident highlights the critical danger of embedding sensitive credentials — such as API keys, tokens, and passwords — directly in source code or pipeline definitions that may be publicly accessible. Attackers harvesting over 3,000 secrets can pivot to downstream systems, amplifying the blast radius far beyond the initially compromised accounts. This matters because CI/CD pipelines often hold privileged access to production environments, cloud infrastructure, and third-party services, making them high-value targets for threat actors seeking lateral movement.
What helps against this
How we list vendors
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
Indicators of Compromise
- malware — GhostAction