New GhostAction Wave Hits Hundreds of Repos, Expanding Beyond CI/CD Secrets to Cloud Credentials

Attackers compromised legitimate GitHub maintainer accounts to inject malicious CI/CD workflows into hundreds of repositories, demonstrating how trusted identities can become the entry point for large-scale supply chain attacks. Beyond stealing GitHub Actions secrets, the campaign scanned full Git histories for cloud and AI service credentials — a critical reminder that secrets committed even briefly to version control history remain a persistent liability. This matters because exposed cloud credentials can grant attackers persistent, wide-ranging access to production infrastructure far beyond the compromised repository itself. Organizations that treat CI/CD pipelines as inherently trusted environments without credential hygiene controls are disproportionately exposed to this class of threat.