Recently, there has been a growing worry about the security of software supply chains because of a large cyberattack campaign called GhostAction. The perpetrators of this attack affected about 1,900 GitHub accounts and struck some 30,000 repositories.
As reported by cybersecurity experts from GitGuardian, the GhostAction campaign became particularly aggressive during October 8 and 9, 2026. The attack involved numerous repositories owned by nearly 3,000 people or organizations. The attackers extracted a total of 3,174 confidential credentials and secrets from public repositories’ continuous integration environments.
Which Technique Was Used in Carrying Out the Attack?
Rather than using various software vulnerabilities, GhostAction took advantage of stolen developer credentials. It is said that unwanted entities have taken GitHub Personal Access Tokens (PATs) and some other vital credentials from the already leaked data and have exploited the compromised accounts in order to perform malicious workflows on the GitHub Action. The flows were made to seem like they executed common security tasks but in reality, they were used to scan and collect sensitive information from different sources, including the cloud tokens, API keys, tokens of package repositories, and secrets for CI/CD pipelines. Furthermore, people dealing with the newest version of the malicious flows have revealed that they could read the history of the Git commits, which would enable them to obtain access to the username and passwords of the devs removed from the necessary code previously.
GitHub Responded to the Attack
From October 9, GitHub has started to prevent malicious workflows from being started, which limited the impact of the attacks executed on October 10 and 12. But the researchers warn that the accounts that were already compromised would still be in danger, which means that hackers might be using the stolen credentials, which have not been exchanged by the companies yet.
What Should Organizations Do?
The incident highlights the importance of protecting developer identities and securing automated development pipelines. Security teams should regularly rotate exposed credentials, review GitHub Actions workflows, enforce multifactor authentication, and monitor repositories for unauthorized changes.
The GhostAction campaign serves as a reminder that compromised developer accounts can create serious security risks, even without exploiting vulnerabilities in the underlying software.
Let’s refine your stalking skills; go through our Instagram and LinkedIn.
