GhostAction attack targeted more than 30,000 GitHub repositories
Subsequent waves on October 10 and 12 got no secrets, because GitHub stopped the workflow from October 9.
GitGuardian says that the GhostAction campaign targeted more than 30,000 repositories on October 8 and 9, 2026. Attackers used about 1,900 compromised accounts and tried to get 3,174 secrets from public repositories. Some victims did not change their secrets, and the attackers use them.
Sources
Posted
