/
data_types_exposed:credentials × threat_actors:GhostAction × limpar

Resultados

2 casos · pág. 1/1

gbhackers.com · high

GhostAction campaign injects credential-stealing GitHub Actions workflows into 790 repositories via hijacked maintainer accounts

GhostAction has returned with an expanded credential-theft operation. By October 9, 2026, attackers had injected malicious GitHub Actions workflows into 790 repositories, according to OpenSourceMalware's validated total. The campaign was first documented by GitGuardian in 2025 (817 repositories, 3,325 stolen secrets). It relies on comprom…

GhostAction technology software development
thehackernews.com · high

GhostAction operators phish GitHub maintainers and plant font-disguised stealer in 94 repositories

The threat actor behind the GhostAction supply chain campaign has expanded beyond malicious GitHub Actions workflows. According to OpenSourceMalware, it now phishes open-source maintainers and plants a second-stage credential stealer disguised as a font file. The shift appears to follow GitHub's October 9 block on the malicious workflow, …

GhostAction technology software development