🕵️ GhostAction

The items that name it 15

• The OpenSourceMalware Show #27
  talkas threat actors2026-10-29It is written here as GhostAction (cited as an example of a threat actor experimenting with payload styles and secondary access).

  cited as an example of a threat actor experimenting with payload styles and secondary access

• Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles
  writeupas classification.key entities2026-10-25
• The OpenSourceMalware Show #26
  talkas classification.key entities2026-10-21
• Glassworm Hacks OVH Clouds CLI tool
  writeupas classification.key entities2026-10-19
• GhostAction Copycats PolinRider by Hiding a Stealer in a Fake Font File
  writeupas classification.key entities2026-10-16
• The OpenSourceMalware Show #25
  talkas classification.key entities2026-10-15
• GhostAction Phishing Campaign
  writeupas classification.key entities2026-10-11
• GhostAction Attack Escalates By Targeting GitHub Users
  writeupas classification.key entities2026-10-09
• GhostAction Returns: Malicious “Security Audit” Workflows Now Mine Credentials from Entire Git Histories
  writeupas threat actors2026-10-09

  First covered by StepSecurity in September 2025, when it stole more than 3,000 secrets across 817 repositories belonging to 327 developers. Still active as of October 2026. Attack chain: compromises maintainer GitHub credentials (likely leaked personal access tokens from infostealer logs), reconnoit

• New GhostAction Wave Hits Hundreds of Repos, Expanding Beyond CI/CD Secrets to Cloud Credentials
  writeupas classification.key entities2026-10-09
• In Other News: AI Used in Korean Bank Breaches, Poem-Guided Botnet, Empire Admin Gets 40 Years
  articleas threat actors2026-10-09

  Secret-stealing GitHub Actions workflow campaign; pushed to 772 public repositories (373 users/organizations) between August 31 and September 30, targeting 2,577 secrets (SSH keys, Azure, AWS, database credentials). Reused 2025 playbook with a new exfiltration server.

• Find Unused, Stale, and OIDC-Replaceable GitHub Actions Secrets Across Your GitHub Organization
  articleas threat actors2026-07-23

  Campaign that committed malicious workflows exfiltrating over 3,000 secrets across hundreds of repositories

• Introducing Secret Exfiltration Protection for GitHub Actions
  articleas threat actors2026-07-16

  September 2025 campaign; compromised GitHub accounts pushed a workflow titled 'Github Actions Security' into hundreds of repositories to exfiltrate secrets on every push. Reached 327 users across 817 repositories and stole 3,325 secrets, including npm, PyPI, and DockerHub tokens.

• Harden-Runner Block Mode Now Available for macOS and Windows GitHub-Hosted Runners
  articleas threat actors2026-07-16

  Stole more than 3,000 secrets through malicious workflows

• GitHub Secret Scanning Public Monitoring for Enterprises: Coverage and Gaps
  articleas threat actors2026-07-12

  Stole over 3,000 secrets through malicious workflows posting to attacker-controlled endpoints.