GitGuardian reported a sharp escalation in GhostAction, a credential-theft campaign against developer infrastructure on GitHub, with the spike observed on 8 and 9 October 2026. Attackers compromised the GitHub accounts of about 1,900 users and pushed malicious GitHub Actions workflows into more than 30,000 repositories across roughly 3,000 users and organisations, attempting to extract 3,174 secrets from public-repository continuous-integration pipelines. Access is gained through stolen personal access tokens or credentials harvested from infostealer logs; the hijacked maintainer accounts then commit malicious workflow files under innocuous names such as security-audit.yml or github_actions_security.yml. The objective is large-scale theft of CI/CD secrets, cloud credentials and package-registry tokens. The campaign sits alongside the week's other supply-chain-identity stories — Docker PAT reassignment, fake Arch AUR packages and a malicious npm cluster — and reinforces that developer identity and CI trust remain the shared weak point across ecosystems.

• Source article