[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fKadJyzYVKh0Wch6sFoKTcHMRH5NO7Es3N6CLwUxrXSk":3},{"article":4,"iocs":55,"watch_terms":60,"solutions":61,"lesson":153},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"4326c493-c8bb-4f5f-a3a7-d05c50266334","Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories","credential-stealing-github-actions-workflows-planted-in-tens-of-thousands-of-rep-bf8959","Cybersecurity researchers have disclosed details of an ongoing credential-theft campaign that has compromised two high-profile open-source maintainer accounts to push a malicious workflow into over 340 repositories. \"Using the account of Takashi Kitao, author of the 18,400-star game engine pyxel, the attacker pushed a malicious workflow to 27 repositories starting at 13:20 UTC,\" StepSecurity","The GhostAction campaign has escalated, compromising high-profile open-source maintainer accounts on GitHub to inject malicious security audit workflows into thousands of repositories. These workflows exfiltrate sensitive secrets like API keys and tokens to a hard-coded IP address. The campaign has already impacted hundreds of repositories and thousands of GitHub users, with attackers leveraging leaked credentials to gain access.","GhostAction campaign compromises GitHub accounts to inject malicious workflows into repositories.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fcredential-stealing-github-actions.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjoJXBEAVVijhwsYs32WSejvp0sG3ej-Qoi7Z6qHDp8rY5IZENkKOpexrbbU1BNyiCbbB0ZXHjEDL-UYqu7CDpPpoYLiGXkuLCZJTItgP5XeLD_Sb1galPzOGtrFZigEM5CGUbwi9gcL_-XCYY6NKu9j5FiakIWn5s66DZE-OjrLZO3sMGka3YNFvGUecJT\u002Fs1600\u002Fgitworm.jpg","2026-10-09T19:14:28+00:00","2026-10-09T22:00:17.963196+00:00",9,[17,20,23,25,27,29],{"name":18,"type":19},"GhostAction","campaign",{"name":21,"type":22},"GitHub Actions","product",{"name":24,"type":22},"pyxel",{"name":26,"type":22},"athenadriver",{"name":28,"type":22},"DevOpsGPT",{"name":30,"type":31},"CI\u002FCD","technology","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":32,"icon":34,"name":35,"slug":36},null,"Supply Chain","supply-chain",[38,40,45,50],{"category":39},{"id":32,"icon":34,"name":35,"slug":36},{"category":41},{"id":42,"icon":34,"name":43,"slug":44},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56],{"type":57,"value":58,"context":59},"ip","193.32.204.199","Attacker-controlled endpoint for exfiltrating secrets.",[21,24,26],{"controls":62,"vendors":143},[63,92,121],{"slug":64,"name":65,"problem":66,"products":67},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[68,76,84],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"slug":93,"name":94,"problem":95,"products":96},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[97,105,113],{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"slug":122,"name":123,"problem":124,"products":125},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[126,134,135],{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",[144,147],{"slug":106,"name":107,"logo_path":108,"roles":145},[146],"affected",{"slug":148,"name":149,"logo_path":150,"roles":151},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png",[152],"reported_by",{"slug":154,"title":155,"body":156,"framework_refs":157,"framework_notes":169},"malicious-github-actions-workflows-steal-secrets-from-thousands-of-repos","Malicious GitHub Actions Workflows Steal Secrets from Thousands of Repos","The GhostAction campaign demonstrates a sophisticated supply chain attack where compromised maintainer accounts were leveraged to inject malicious CI\u002FCD workflows into thousands of open-source repositories. By abusing trusted GitHub Actions pipelines, attackers silently exfiltrated API keys, tokens, and other secrets to attacker-controlled infrastructure — a technique that is especially dangerous because workflows are often treated as trusted automation. This matters because developers and downstream users of these repositories may unknowingly execute malicious code, cascading the breach across entire ecosystems. The use of leaked credentials as the initial access vector highlights that a single compromised account in a position of trust can have outsized consequences across thousands of projects.",[158,159,160,161,162,163,164,165,166,167,168],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 6: Access Control Management","CIS Control 16: Application Software Security","NIST SP 800-161: Supply Chain Risk Management","NIST AC-2: Account Management","NIST AC-6: Least Privilege","NIST SI-7: Software, Firmware, and Information Integrity","NIST DE.CM-3: Personnel Activity Monitoring","GDPR Article 32: Security of Processing","SLSA Framework: Supply Chain Levels for Software Artifacts","OpenSSF Scorecard: Dangerous Workflow Check",{}]