// GitHubHIGH
The GhostAction malicious workflow campaign has compromised 772 public repositories across 373 GitHub users and organizations between August 31 and September 30, 2026. Attackers injected malicious GitHub Actions workflows disguised as security checks to steal SSH keys, cloud credentials, Azure/AWS access keys, and GitHub tokens. Researchers confirmed successful exfiltration of 3,325+ secrets, with 26 secrets confirmed stolen from 13 repositories. Only 16% of affected repositories showed effective remediation by early October.
// Get alerts for GitHub