Cyber AttacksGhostAction Hackers Compromise 500+ GitHub Accounts to Steal API CredentialsThreat TimesOct 11, 2026A new campaign by GhostAction has expanded to over 500 compromised accounts, injecting malicious workflows into tens of thousands of repositories since October 2026.
Cloud SecurityGhostAction Campaign Targets Hundreds of GitHub Repos for Cloud and AI CredentialsThreat TimesOct 11, 2026Socket research reveals a new wave of the GhostAction malware campaign stealing cloud and AI credentials from hundreds of GitHub repositories.