News Cyber Attacks
GhostAction hijacks maintainer accounts to plant secret-stealing GitHub workflows
On 8 October 2026, attackers used two compromised open-source maintainer accounts to push a fake "Security Audit" GitHub Actions workflow into 345 repositories. The workflow sends repository secrets, and credentials found anywhere in the git history, to an attacker-controlled server.
Jaydeep Bhatt
