henrywoo

Named by 2 kept items in this workspace.

1 items name it under classification.key entities and 1 under threat actors.

Search every workspace for henrywoo. It matches the name as written, so it can find other things that share it.

The items that name it 2

GhostAction Returns: Malicious “Security Audit” Workflows Now Mine Credentials from Entire Git Histories
writeupas classification.key entities2026-10-09
New GhostAction Wave Hits Hundreds of Repos, Expanding Beyond CI/CD Secrets to Cloud Credentials
writeupas threat actors2026-10-09It is written here as henrywoo (compromised GitHub account).
Compromised maintainer account used to push the malicious security-audit.yml workflow to 318 repositories (39 source repos and 279 forks) under the henrywoo namespace plus uber/athenadriver, between 21:10:15Z and 21:26:32Z on October 8, 2026. henrywoo is the original author of athenadriver, which ac

All threat actors in this workspace.