Ethical Hacking News
The GhostAction supply chain attack campaign has compromised over 1,900 GitHub accounts and targeted more than 30,000 repositories, resulting in the theft of sensitive information. The attack highlights the devastating consequences of a supply chain attack and the need for developers to take steps to protect their accounts and repositories.
The GhostAction supply chain attack campaign compromised over 1,900 GitHub user accounts and targeted more than 30,000 repositories.The attackers gained write access to repositories using stolen Personal Access Tokens (PATs) or credentials harvested from infostealer logs and dumps.The end goal of the attack was to steal CI/CD secrets, cloud credentials, package registry tokens, and AI provider API keys.A second wave of attacks was observed in October 2026, with the malicious workflow pushed to hundreds of repositories.GitHub started preventing the malicious workflow from running starting October 9, resulting in the attackers being unable to extract secrets from some repositories.The attack highlights the need for developers to be vigilant and to take steps to protect their accounts and repositories.The campaign is a wake-up call for the developer community and the broader cybersecurity landscape.
The cybersecurity landscape has witnessed numerous high-profile attacks in recent times, with some of the most devastating ones targeting the developer infrastructure on GitHub. The latest development in this area is the GhostAction supply chain attack campaign, which has compromised the GitHub accounts of over 1,900 users and targeted more than 30,000 repositories. The attack, which was first discovered in September 2025, involves threat actors compromising legitimate developer accounts to inject malicious GitHub Actions automation workflows into software repositories.
The attackers have been found to gain write access to repositories using stolen Personal Access Tokens (PATs) or credentials harvested from infostealer logs and dumps. Using the hijacked maintainer account, they push a malicious workflow file disguised under deceptive names such as Security Audit ("security-audit.yml") or GitHub Actions Security ("github_actions_security.yml"). The end goal of the activity is the large-scale theft of continuous integration and continuous deployment (CI/CD) secrets, cloud credentials, package registry tokens (like npm, PyPI, and DockerHub), and artificial intelligence (AI) provider API keys.
The GhostAction campaign has been observed to have a new wave of attacks since August 31, 2026, with the malicious workflow pushed to hundreds of repositories. The new wave seems more experimental and manual than previous ones, with the payload evolving over time. A second version of the payload also captures about two lines of context around every AWS key ID hit so as to pair them with their matching secret access keys. A third and final variant of the payload includes support for retrieving the secret context during the git history scan.
GitGuardian, a leading threat intelligence firm, has reported that this payload was deployed in multiple phases. First to 160 previously observed victims, then, 20 minutes later, to 28,000 new repositories between October 8 and 9. New waves have been observed, using the same payload, on October 10 and 12. However, GitHub started preventing the malicious workflow from running starting October 9. Those two subsequent waves therefore could not extract any secrets.
Interestingly, a subset of the victims from this new burst were previously compromised in the September 2025 and August 2026 waves, indicating the threat actors are banking on unrotated secrets to pull them off. The threat actors have been using the stolen credentials to gain access to repositories and push the malicious workflow, which is designed to extract sensitive information.
The GhostAction campaign is a prime example of the devastating consequences of a supply chain attack on a platform like GitHub. The attackers have been able to compromise the accounts of over 1,900 users and target more than 30,000 repositories, resulting in the theft of sensitive information. The fact that the attackers were able to push the malicious workflow to hundreds of repositories in a matter of minutes highlights the urgency of the situation.
The cybersecurity community is taking note of the GhostAction campaign, with many experts warning of the dangers of supply chain attacks. The attack highlights the need for developers to be vigilant and to take steps to protect their accounts and repositories. It also underscores the importance of maintaining up-to-date software and systems, as well as regularly monitoring for suspicious activity.
In conclusion, the GhostAction supply chain attack campaign is a wake-up call for the developer community and the broader cybersecurity landscape. The attack highlights the devastating consequences of a supply chain attack and the need for developers to take steps to protect their accounts and repositories.
Related Information:
https://www.ethicalhackingnews.com/articles/GhostAction-Compromises-The-Devastating-Consequences-of-a-Supply-Chain-Attack-on-GitHub-ehn.shtml
https://thehackernews.com/2026/10/ghostaction-compromises-about-1900.html
Published: Thu Oct 15 06:47:38 2026 by llama3.2 3B Q4_K_M
