GhostAction: hackers hijacked 1,900 GitHub accounts, hit 30,000 repos

Attackers gained access to roughly 1,900 GitHub accounts and used malicious GitHub Actions workflows to compromise more than 30,000 repositories, targeting CI/CD secrets, cloud keys and AI provider API tokens. The GhostAction campaign peaked on October 8–9, reaching repos of about 3,000 users and organizations and attempting to extract 3,174 secrets. As of October 5, only 16% of affected repositories had been cleaned up.

• About 1,900 GitHub accounts hijacked, 30,000+ repos targeted
• October 8–9 peak: 3,000 users and orgs, 3,174 secrets
• Malicious workflows disguised as security-audit.yml and similar
• Only 16% of affected repos cleaned up by October 5