GhostAction compromises about 1,900 GitHub accounts and targets more than 30,000 repositories
A campaign used compromised accounts to plant malicious automation in GitHub Actions and steal development secrets and cloud credentials.
What happened
The campaign used compromised accounts to plant malicious automation in GitHub Actions and steal development secrets, cloud credentials, package publishing tokens and AI provider keys. GitHub blocked execution of some of the later waves.
Why it matters
A compromised developer account can open the door to infrastructure, deployments and products used by other companies. It is a clear supply-chain risk.
What we recommend
Phishing-resistant two-factor authentication on every developer account; review recently changed GitHub Actions workflows; rotate cloud secrets, package registry tokens and AI keys; use short-lived credentials instead of static secrets; and protect the workflows folder with mandatory review.
Related service: Software Development
Want to know how it affects you?
We review your environment and tell you what to prioritise, with no commitment.