GhostAction campaign harvests CI secrets via fake GitHub Actions workflows

Since October 7, a campaign dubbed GhostAction has injected fake "security audit" workflows into legitimate repos through compromised maintainer accounts. GitGuardian counts a second wave hitting 772+ more repositories, while StepSecurity puts the tally at 3,000+ secrets stolen. The attack exploits trusted CI automation rather than a GitHub zero-day.

• Second GhostAction wave hit 772+ repositories
• StepSecurity estimates 3,000+ secrets stolen
• AWS, OpenAI, GitHub and PyPI keys exfiltrated over HTTP to 193.32.204.199
• Workflow with fetch-depth: 0 reads secrets from full git history