GhostAction hacking wave fizzles, but attackers remain in GitHub

The GhostAction supply chain attack campaign has lost momentum, but attackers are shifting toward developer endpoints and cloud access. The move signals what the cybercrime group may target next.

• GhostAction campaign is no longer showing its previous activity
• Attackers shifted focus to developer endpoints
• Cloud access and GitHub accounts may be the next target