GhostAction's fake 'security audit' workflows now mine entire git history for secrets. https://intel.threadlinqs.com/threat/TL-2026-3157 #ThreatIntel #xmrig #GhostAction #GitHub
@threadlinqs.bsky.social
@threadlinqs.bsky.socialGhostAction's fake 'security audit' workflows now mine entire git history for secrets. https://intel.threadlinqs.com/threat/TL-2026-3157 #ThreatIntel #xmrig #GhostAction #GitHub
@hacks.grSocket says more than 500 GitHub accounts added a malicious file across tens of thousands of repositories.
It searches project history too, incl…
@thedailytechfeed.comGhostAction compromise hits 346 GitHub repos—steals secrets from workflows & history. #GhostAction #GitHub #Security #CI/CD #SupplyChain #Leaks https://thedailytechfeed.com/ghostaction-attack-hits-346-github-repos-exposes-ci-cd-secrets/
@hacks.grGhostAction affected 346 GitHub projects, Socket reports.
A fake security-check workflow ran when developers uploaded code, colle…
@cyfar.ca@socket.dev
Malicious workflows steal CI secrets and cloud credentials from working trees and full Git history.
-
IOCs: 193[.]32[.]204[.]199
-
#GhostAction #SupplyChain #ThreatIntel
@hacks.grGhostAction added deceptive automation files to 772 public GitHub projects.
GitGuardian says 26 credentials were stolen from 13 projects.
By Oct.
5, only 124 pr…
https://en.hacks.gr/i-kampania-ghostaction-eklepse-26-stoicheia-prosvasis-apo-13-erga-sto-github/
@thedailytechfeed.comGhostAction targets 772 GitHub repos, steals SSH, cloud & API credentials via fake Actions workflows. #SupplyChain #GitHubActions #GhostAction #CI/CD #DevSecOps #SecurityNews https://thedailytechfeed.com/ghostaction-supply-chain-campaign-steals-ci-cd-secrets-via-malicious-github-actions/
