gitguardian.comPublished
The GhostAction Campaign: 3,325 Secrets Stolen Through Compromised GitHub Workflows
By Gaetan Ferry
Excerpt
👉
TL;DR: GitGuardian discovered and investigated the GhostAction campaign, which compromised 327 GitHub users across 817 repositories, stealing 3,325 secrets through malicious workflows disguised as "Github Actions Security." Attackers extracted PyPI, npm, DockerHub, and AWS credentials via HTTP POST to a remote endpoint. 24 packages remain at immediate risk of malicious releases.
Update: October 6, 2026
GhostAction is back again. Read our analysis of the new wave.
Update: September 15, 2026
On September 9th, we observed a second wave in the GhostAct…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by gitguardian.com on blog.gitguardian.com.
Mentioned in the excerpt
On the same topics
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Trust the Tunnel, Get the Trojan: Silver Fox Delivers Atlas RAT via Weaponized VPN Installershexastrike.com · Published 25 Mar
- Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent TrafficThe Hacker News · Published 19 Oct
- Investigating Ephemeral Supply Chain TamperingMandiant (Google) · Published 15 Oct
