[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f62tSFFp7zhW1eMXNGA6pXRo5SpL3H0_E5P4RIomSf2o":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":54},"b6121ea4-a3a6-465f-87b2-4510cb4357c5","ghostaction-injects-malicious-cicd-workflows-to-harvest-cloud-credentials-across-500-github-accounts","b8e985de-3658-4f4a-990c-67d3187ba2ab","GhostAction Injects Malicious CI\u002FCD Workflows to Harvest Cloud Credentials Across 500+ GitHub Accounts","The GhostAction campaign demonstrates how attackers can weaponize trusted developer platforms like GitHub by injecting malicious CI\u002FCD workflows that silently harvest secrets embedded in repositories and git history. Organizations frequently store sensitive credentials — AWS keys, OpenAI tokens, and package manager secrets — directly in code or configuration files, making them trivially accessible once a workflow is compromised. This attack is particularly dangerous because it exploits the implicit trust developers place in automated pipelines, turning a development tool into a credential-exfiltration engine. The ripple effect across thousands of downstream repositories elevates this from an account compromise to a full-scale supply chain threat affecting any consumer of the poisoned packages or infrastructure.","**Immediate actions:**\n- Rotate all cloud, AI, and package manager credentials (AWS, OpenAI, npm, PyPI, etc.) for any repository that uses GitHub Actions or was recently forked\u002Fstarred by unknown accounts.\n- Audit all existing GitHub Actions workflow files in your repositories for unexpected steps, curl calls, or base64-encoded payloads.\n- Enable GitHub secret scanning and push protection on every repository to block credentials from being committed.\n\n**Long-term improvements:**\n- Enforce a secrets management policy that prohibits storing credentials in source code or git history, using tools such as HashiCorp Vault, AWS Secrets Manager, or GitHub Encrypted Secrets exclusively.\n- Apply the principle of least privilege to all CI\u002FCD pipeline tokens, restricting permissions to only the specific actions each workflow requires.\n- Pin GitHub Actions to a specific commit SHA rather than a mutable tag to prevent malicious updates from silently altering workflow behaviour.\n\n**Detection measures:**\n- Implement continuous monitoring and alerting on cloud provider credential usage (e.g., AWS CloudTrail, OpenAI API logs) to detect anomalous access patterns that may indicate stolen key usage.\n- Integrate a software composition analysis (SCA) and CI\u002FCD pipeline integrity tool (e.g., Sigstore, SLSA) to verify the provenance and integrity of third-party Actions before execution.\n- Establish a formal review and approval gate for any changes to workflow files (`\u002F.github\u002Fworkflows\u002F`) requiring a second committer sign-off.",[12,13,14,15,16,17,18],"MITRE ATT&CK T1566: Phishing","CIS Control 7: Continuous Vulnerability Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","CIS Control 17: Incident Response Management","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":20,"MITRE ATT&CK T1566: Phishing":21,"NIST SP 800-53 SI-2: Flaw Remediation":22,"CIS Control 17: Incident Response Management":23,"CIS Control 7: Continuous Vulnerability Management":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"NIS2 requires supply chain security measures; organisations relying on GitHub-hosted pipelines must assess and manage the security of those third-party environments as part of their broader risk management obligations.","GhostAction gains initial access by compromising GitHub accounts, likely through credential phishing or token theft, making phishing-resistant authentication (hardware MFA) the first preventive control.","Treating the presence of hardcoded secrets in repositories as a remediable flaw — with scanning and mandatory rotation policies — would close the credential exposure vector GhostAction exploits.","A rehearsed incident response playbook for compromised CI\u002FCD credentials — covering immediate rotation, pipeline quarantine, and downstream consumer notification — limits damage once a GhostAction compromise is detected.","Regularly scanning repositories and CI\u002FCD pipeline configurations for exposed secrets and malicious workflow injections would detect GhostAction-style modifications before credentials are exfiltrated.","A formal process for identifying and remediating technical weaknesses in development pipelines, including insecure workflow configurations and stored secrets, maps directly to preventing this attack.","Enforcing strong authentication and least-privilege access on GitHub accounts and pipeline tokens directly limits the blast radius when any single account is compromised by this campaign.","published","2026-11-09T17:20:24.57499+00:00","2026-11-09T17:20:24.554+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fcybersecuritynews.com\u002Fghostaction-github-account-compromise\u002F","ghostaction-hackers-compromise-500-github-accounts-to-steal-aws-openai-and-cloud-bc2371","GhostAction Hackers Compromise 500+ GitHub Accounts to Steal AWS, OpenAI, and Cloud Credentials",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":42,"name":43,"slug":44,"description":45,"color":46},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[48],{"id":49,"date":50,"edition":51,"title":52,"audio_url":53},"4bcbfc51-fbf1-4909-badf-a664c9188111","2026-11-10","morning","ThreatNoir Morning Brief — November 10","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-11-10\u002Fthreatnoir-morning-brief-2026-11-10.mp3",[55,59,63],{"slug":56,"name":57,"problem":58},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":60,"name":61,"problem":62},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",{"slug":64,"name":65,"problem":66},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship."]