GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories

Overview

The credential-theft campaign known as GhostAction has ramped up, targeting more than 30,000 repositories across 3,000 users and organizations. The spike, according to GitGuardian, was observed on October 8 and 9, 2026. "This resulted from compromising the GitHub accounts of about 1,900 users. It attempted to extract 3,174 secrets from public repositories' CI," security researchers Gaetan

SpinGraph analysis pending — check back after processing.