GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories

The GhostAction credential-theft campaign has escalated, compromising about 1,900 GitHub accounts and targeting more than 30,000 repositories, The Hacker News reports. According to GitGuardian, attackers used the hijacked accounts to inject malicious GitHub Actions workflows and attempted to extract more than 3,100 secrets from public repositories' CI pipelines.