GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories

The GhostAction credential-theft campaign has escalated, targeting over 30,000 repositories belonging to 3,000 users and organizations. This surge was observed on October 8 and 9, 2026. Approximately 1,900 GitHub accounts were compromised as a result. The campaign attempted to extract 3,174 secrets from public repositories' continuous integration systems. The compromised accounts were used to target a large number of repositories. Security researchers at GitGuardian detected the spike in activity.