#ghostaction

2 articles

GhostAction reached 30,000 repositories in two days. The only wave anyone has measured gave up 26 secrets

2026-10-15Security

GitGuardian's update records about 1,900 compromised GitHub accounts and more than 30,000 repositories targeted on 8 and 9 October. The number missing from every headline is how many secrets the campaign actually took, and the one wave with a published answer makes the gap look enormous.

The workflow was called security-audit.yml, and each copy named the secrets that repository actually used

2026-10-12Security

Socket's latest GhostAction wave commits a credential-stealing GitHub Actions workflow straight to default branches. The payload is reusable, but the attackers read each repository's existing workflows first to learn which secret names to ask for. The October variant also sweeps the full git history.