GitHub threat report

GhostAction campaign returned with an expanded credential-theft operation, injecting malicious GitHub Actions workflows into 790 repositories as of October 9, 2026. Attackers exploited compromised maintainer accounts to push security-themed workflows that steal CI/CD secrets and search repository history for credentials including AWS, GitHub, GitLab tokens, and AI-service keys. The new variant exfiltrates data to an attacker-controlled IP (193.32.204.199) and can expose credentials committed long ago.

• GhostAction Hackers Inject Malicious Security Workflows Into 790(opens in a new tab)