GhostAction campaign breaches 500-plus GitHub accounts
A new wave of the GhostAction campaign has compromised more than 500 GitHub accounts. The attackers used those accounts to plant a fake security workflow across tens of thousands of repositories, and the workflow steals cloud, AI, and publishing credentials. Malicious workflow planted across repositories Security firm Socket says the affected accounts began adding the malicious file on October 7, 2026. Some of the repositories belong to large organizations. On…