GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories

The GhostAction credential-theft campaign has significantly escalated, targeting over 30,000 repositories across 3,000 users and organizations on GitHub. The surge was observed on October 8 and 9, 2026, according to security firm GitGuardian. Approximately 1,900 GitHub accounts were compromised during the campaign. Attackers attempted to extract 3,174 secrets from public repositories' CI pipelines. The campaign represents a large-scale supply chain threat targeting developer credentials and sensitive secrets stored in CI/CD environments. The scale of the attack highlights ongoing risks to open-source and developer ecosystems hosted on GitHub.