Security1 hOctober 14, 2026, 00:12

GhostAction returns: 772 repos hit in new GitHub Actions wave

The GhostAction supply chain campaign resumed between Aug 31 and Sept 30, 2026, injecting a malicious workflow into 772 public repositories across 373 GitHub users. The attack exfiltrates CI/CD secrets, including SSH keys and cloud credentials, to the IP address 193.32.204.199.

DEV Community

Open source

GhostAction returns: 772 repos hit in new GitHub Actions wave

772 repositories and 373 accounts affected between Aug 31 and Sept 30, 2026
2,577 secrets targeted, including SSH keys, Azure, AWS and DockerHub credentials
Only 499 of 3,669 workflow runs executed; exfiltration confirmed in 13 repos
Just 124 repositories (16%) were cleaned in public history by Oct 5

#GitHub#GitGuardian#Socket

GhostAction campaign harvests CI secrets via fake GitHub Actions workflows

Security

FakeGit malware campaign returns with 17,610 malicious GitHub repos

Security

Shai-Hulud worm in Tensorlake npm SDK steals AI agent credentials

Security

GhostAction returns: 772 repos hit in new GitHub Actions wave

GhostAction campaign harvests CI secrets via fake GitHub Actions workflows

FakeGit malware campaign returns with 17,610 malicious GitHub repos

Shai-Hulud worm in Tensorlake npm SDK steals AI agent credentials

New Shai-Hulud worm scans 469 credential paths