GhostAction Hackers Compromise 500+ GitHub Accounts to Steal AWS, OpenAI, and Cloud Credentials

The GhostAction campaign demonstrates how attackers can weaponize trusted developer platforms like GitHub by injecting malicious CI/CD workflows that silently harvest secrets embedded in repositories and git history. Organizations frequently store sensitive credentials — AWS keys, OpenAI tokens, and package manager secrets — directly in code or configuration files, making them trivially accessible once a workflow is compromised. This attack is particularly dangerous because it exploits the implicit trust developers place in automated pipelines, turning a development tool into a credential-exfiltration engine. The ripple effect across thousands of downstream repositories elevates this from an account compromise to a full-scale supply chain threat affecting any consumer of the poisoned packages or infrastructure.