GhostAction supply chain campaign hits tens of thousands of GitHub repositories, now stealing cloud and AI credentials
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 09/11/2026 12:15; os links antigos trazem para cá.
Fontes: gbhackers.com ↗ darkreading.com ↗
The GhostAction supply chain campaign targeting GitHub is still active. In late October 2026, Dark Reading (darkreading.com) described it as waning on the platform but shifting toward developer endpoints and cloud access, and presented that shift as a possible sign of the operators' next targets. By 9 November 2026, GBHackers (gbhackers.com) reported a new wave that pushed a credential-stealing GitHub Actions workflow into tens of thousands of repositories. This wave hunts for cloud and AI keys in source code and git history, in addition to CI/CD secrets. The later report is more recent and describes much larger scale than the earlier "waning" characterisation. Neither source names a threat actor, victims, CVEs or IOCs.
Detalhes técnicos
- Campaign type: supply chain attack abusing GitHub-hosted development workflows (darkreading.com).
- Current wave: a malicious GitHub Actions workflow is injected into tens of thousands of repositories to steal credentials (gbhackers.com).
- Targeted secrets: CI/CD secrets, plus cloud and AI keys embedded in source code and git history (gbhackers.com).
- Reported evolution: increasing focus on developer endpoints and cloud access (darkreading.com).
- No CVEs, IOCs or named threat actor are stated in the available text.
Remediação
The available sources give no remediation guidance. Defenders should treat this as unconfirmed by the sources and review their own exposure: unexpected workflow files in repositories, and any cloud, AI or CI/CD secrets that may have been committed to source or git history.
Relatos divergentes
- Momentum: Dark Reading (darkreading.com, 28 October 2026) said the campaign appeared to be losing momentum on GitHub, while GBHackers (gbhackers.com, 9 November 2026) reports a new wave reaching tens of thousands of repositories. The GBHackers report is more recent and indicates the campaign is not fading.
- Focus: Dark Reading points to developer endpoints and cloud access, while GBHackers emphasises cloud and AI credentials in repositories and git history. These may be complementary rather than contradictory.
Linha do tempo
-
GhostAction Attack Hits Tens of Thousands of GitHub Repositories to Steal Cloud and AI Credentials
ler a análise desta fonte ocultar
A new wave of the GhostAction supply chain campaign has pushed a credential-stealing GitHub Actions workflow into tens of thousands of repositories.
It now hunts for cloud and AI keys buried in source code and git history, in addition to CI/CD secrets.
-
darkreading.com ↗ · pub. 28/10/2026 16:39 · coletado 28/10 21:00 primeiro registro só resumo do feed
GhostAction supply chain campaign wanes but persists on GitHub, shifting toward developer endpoints and cloud access
ler a análise desta fonte ocultar
The GhostAction supply chain attack campaign targeting GitHub appears to be losing momentum, but the operators remain active on the platform. According to Dark Reading, the campaign is shifting its focus toward developer endpoints and cloud access. Dark Reading presents this shift as a possible indicator of what the cybercrime outfit behind it may target next. The article excerpt provides no further detail on victims, scale, IOCs or attribution.
Technical Details
- Campaign type: supply chain attack against GitHub-hosted development workflows.
- Reported evolution: increased targeting of developer endpoints and cloud access.
- No CVEs, IOCs or named threat actor are stated in the available text.
Remediation
The available text gives no remediation guidance.