[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fo1Wf-VaNfrZK8SVqphZLwu_P0IJ6X2p3elBlLo9gC1A":3},{"article":4,"iocs":55,"watch_terms":63,"solutions":64,"lesson":162},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"b8e985de-3658-4f4a-990c-67d3187ba2ab","GhostAction Hackers Compromise 500+ GitHub Accounts to Steal AWS, OpenAI, and Cloud Credentials","ghostaction-hackers-compromise-500-github-accounts-to-steal-aws-openai-and-cloud-bc2371","A new wave of the GhostAction campaign has hit more than 500 GitHub accounts. The attackers use those accounts to plant a fake security workflow in tens of thousands of repositories, and the workflow steals cloud, AI, and publishing keys. Security firm Socket reports that the accounts added the malicious file starting October 7, 2026, […] The post GhostAction Hackers Compromise 500+ GitHub Accounts to Steal AWS, OpenAI, and Cloud Credentials appeared first on Cyber Security News.","The GhostAction campaign has resurfaced, compromising over 500 GitHub accounts to inject malicious security workflows into thousands of repositories. These workflows steal sensitive cloud, AI, and publishing keys by searching repository files and git history. The attackers are targeting credentials for AWS, OpenAI, and package managers, posing a significant supply chain risk.","GhostAction hackers compromised 500+ GitHub accounts to steal cloud and AI credentials.","https:\u002F\u002Fcybersecuritynews.com\u002Fghostaction-github-account-compromise\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FGhostAction-GitHub-account-compromise-1.webp","2026-11-09T16:29:38+00:00","2026-11-09T17:00:32.887912+00:00",9,[17,20,23,25,27,30],{"name":18,"type":19},"GhostAction","threat_actor",{"name":21,"type":22},"GitHub Actions","product",{"name":24,"type":22},"AWS",{"name":26,"type":22},"OpenAI",{"name":28,"type":29},"Socket","vendor",{"name":31,"type":29},"Uber","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":32,"icon":34,"name":35,"slug":36},null,"Threat Intelligence","threat-intelligence",[38,43,48,53],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":54},{"id":32,"icon":34,"name":35,"slug":36},[56,60],{"type":57,"value":58,"context":59},"ip","193.32.204.199","IP address where stolen secrets are sent.",{"type":47,"value":61,"context":62},"security-audit.yml","Name of the malicious workflow file planted by attackers.",[28,31,21],{"controls":65,"vendors":150},[66,95,124],{"slug":67,"name":68,"problem":69,"products":70},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[71,79,87],{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"slug":96,"name":97,"problem":98,"products":99},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[100,108,116],{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"slug":125,"name":126,"problem":127,"products":128},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[129,137,142],{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":138,"product_name":139,"url":140,"description":141},"jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",{"vendor_slug":143,"vendor_name":144,"vendor_logo":145,"product_slug":146,"product_name":147,"url":148,"description":149},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",[151,157],{"slug":152,"name":153,"logo_path":154,"roles":155},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png",[156],"affected",{"slug":158,"name":28,"logo_path":159,"roles":160},"socket","\u002Fvendor-logos\u002Fsocket.png",[161],"reported_by",{"slug":163,"title":164,"body":165,"framework_refs":166,"framework_notes":174},"ghostaction-injects-malicious-cicd-workflows-to-harvest-cloud-credentials-across-500-github-accounts","GhostAction Injects Malicious CI\u002FCD Workflows to Harvest Cloud Credentials Across 500+ GitHub Accounts","The GhostAction campaign demonstrates how attackers can weaponize trusted developer platforms like GitHub by injecting malicious CI\u002FCD workflows that silently harvest secrets embedded in repositories and git history. Organizations frequently store sensitive credentials — AWS keys, OpenAI tokens, and package manager secrets — directly in code or configuration files, making them trivially accessible once a workflow is compromised. This attack is particularly dangerous because it exploits the implicit trust developers place in automated pipelines, turning a development tool into a credential-exfiltration engine. The ripple effect across thousands of downstream repositories elevates this from an account compromise to a full-scale supply chain threat affecting any consumer of the poisoned packages or infrastructure.",[167,168,169,170,171,172,173],"MITRE ATT&CK T1566: Phishing","CIS Control 7: Continuous Vulnerability Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","CIS Control 17: Incident Response Management","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":175,"MITRE ATT&CK T1566: Phishing":176,"NIST SP 800-53 SI-2: Flaw Remediation":177,"CIS Control 17: Incident Response Management":178,"CIS Control 7: Continuous Vulnerability Management":179,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":180,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":181},"NIS2 requires supply chain security measures; organisations relying on GitHub-hosted pipelines must assess and manage the security of those third-party environments as part of their broader risk management obligations.","GhostAction gains initial access by compromising GitHub accounts, likely through credential phishing or token theft, making phishing-resistant authentication (hardware MFA) the first preventive control.","Treating the presence of hardcoded secrets in repositories as a remediable flaw — with scanning and mandatory rotation policies — would close the credential exposure vector GhostAction exploits.","A rehearsed incident response playbook for compromised CI\u002FCD credentials — covering immediate rotation, pipeline quarantine, and downstream consumer notification — limits damage once a GhostAction compromise is detected.","Regularly scanning repositories and CI\u002FCD pipeline configurations for exposed secrets and malicious workflow injections would detect GhostAction-style modifications before credentials are exfiltrated.","A formal process for identifying and remediating technical weaknesses in development pipelines, including insecure workflow configurations and stored secrets, maps directly to preventing this attack.","Enforcing strong authentication and least-privilege access on GitHub accounts and pipeline tokens directly limits the blast radius when any single account is compromised by this campaign."]