[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fB_LKQH6QJYQiTgfLN7GPjvkDEaAbzYp_uxcvcmoBt2E":3},{"article":4,"iocs":44,"watch_terms":48,"solutions":49,"lesson":140},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"6dea7f85-60db-4d40-863f-9dc7b684a16d","GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories","ghostaction-compromises-about-1-900-github-accounts-targets-over-30-000-reposito-871699","The credential-theft campaign known as GhostAction has ramped up, targeting more than 30,000 repositories across 3,000 users and organizations. The spike, according to GitGuardian, was observed on October 8 and 9, 2026. \"This resulted from compromising the GitHub accounts of about 1,900 users. It attempted to extract 3,174 secrets from public repositories' CI,\" security researchers Gaetan","The credential-theft campaign dubbed GhostAction has significantly increased its activity, impacting over 30,000 repositories belonging to 3,000 users and organizations. This surge, observed on October 8-9, 2026, resulted from the compromise of approximately 1,900 GitHub accounts. Researchers noted attempts to extract 3,174 secrets from public repositories' CI\u002FCD pipelines.","GhostAction campaign compromises 1,900 GitHub accounts, targets 30,000+ repositories.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fghostaction-compromises-about-1900.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEiddFchlm_nV3vywI0BM2-8IaZb-wHXwE8DplGqZYkRmcYkeXiSLfVmnVAU-jM4yikWW7SWokanh_S4hq88cVHjAnaWDGkl3VVAtPdv9SHWp0MNb0CIOAA-I73EuwwUSE-wNMnXEzbIdDYorJn2hIuBZQ5Jh_5I2IntiXuUYZz3sKax-wfRoaxy_pD9kGx0\u002Fs1600\u002Fghost-git.jpg","2026-10-15T08:45:10+00:00","2026-10-15T10:00:15.843553+00:00",8,[17,20],{"name":18,"type":19},"GitHub","product",{"name":21,"type":22},"CI\u002FCD","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":23,"icon":25,"name":26,"slug":27},null,"Malware","malware",[29,34,39],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":40},{"id":41,"icon":25,"name":42,"slug":43},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[45],{"type":27,"value":46,"context":47},"GhostAction","Name of the credential-theft campaign",[18],{"controls":50,"vendors":136},[51,80,108],{"slug":52,"name":53,"problem":54,"products":55},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[56,64,72],{"vendor_slug":57,"vendor_name":58,"vendor_logo":59,"product_slug":60,"product_name":61,"url":62,"description":63},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"slug":81,"name":82,"problem":83,"products":84},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[85,92,100],{"vendor_slug":86,"vendor_name":18,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"github","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",{"slug":43,"name":109,"problem":110,"products":111},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[112,120,128],{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",[137],{"slug":86,"name":18,"logo_path":87,"roles":138},[139],"affected",{"slug":141,"title":142,"body":143,"framework_refs":144,"framework_notes":158},"ghostaction-credential-theft-hits-1900-github-accounts-and-30000-repos","GhostAction Credential Theft Hits 1,900 GitHub Accounts and 30,000+ Repos","The GhostAction campaign exploited compromised GitHub credentials to gain unauthorized access to thousands of repositories, targeting secrets stored within CI\u002FCD pipeline configurations. This incident highlights the critical danger of embedding sensitive credentials — such as API keys, tokens, and passwords — directly in source code or pipeline definitions that may be publicly accessible. Attackers harvesting over 3,000 secrets can pivot to downstream systems, amplifying the blast radius far beyond the initially compromised accounts. This matters because CI\u002FCD pipelines often hold privileged access to production environments, cloud infrastructure, and third-party services, making them high-value targets for threat actors seeking lateral movement.",[145,146,147,148,149,150,151,152,153,154,155,156,157],"CIS Control 3: Data Protection","CIS Control 5: Account Management","CIS Control 6: Access Control Management","CIS Control 16: Application Software Security","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 AC-6: Least Privilege","NIST SP 800-53 IA-5: Authenticator Management","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 AU-6: Audit Record Review","NIST CSF DE.CM-3: Personnel Activity Monitoring","NIST CSF PR.AC-1: Identities and Credentials Managed","OWASP CI\u002FCD Security Top 10: CICD-SEC-6 Insufficient Credential Hygiene","GDPR Article 32: Security of Processing",{}]