kyber.today

daily cyber × ai intelligence

← threat actors

threat actor

GhostAction

3 stories · 3 in the wild · October 10, 2026 – October 20, 2026

evidence: 3 observed

how they got in

  • stolen credentials 2 · Oct 16
  • phishing email 1 · Oct 20

sectors

  • developers 3 · Oct 20
  • technology 1 · Oct 10

malware and tools

  • credential stealer 1 · Oct 20

techniques

  • credential access 2 · Oct 20
  • execution 1 · Oct 20
  • phishing 1 · Oct 20
  • credential theft 1 · Oct 16
  • exfiltration 1 · Oct 10

attack phases seen

  • Credential access 3 · Oct 20
  • Exfiltration 2 · Oct 16
  • Execution 1 · Oct 20
  • Initial access 1 · Oct 20

what we reported, newest first, grouped by story

Oct 10 – October 20, 2026 · 3 reports

  • GhostAction has added reverse-proxy phishing and OAuth device authorization to its GitHub workflow attacks. A fake security alert harvested passwords and 2FA codes, then used JavaScript to authorize an OAuth flow with repo, workflow, and read:org permissions. The report also ties a credential stealer disguised as a font to 94 repositories, showing the operator adapting after GitHub disrupted its malicious Actions workflows. The Hacker News (earlier coverage) · Oct 20 · observed · via phishing email · Supply Chain, Cloud & Identity
  • GhostAction’s latest wave targeted more than 30,000 repositories after roughly 1,900 GitHub accounts were compromised. On October 8 and 9, the campaign reached repositories across 3,000 users and organizations and attempted to extract 3,174 secrets from public repositories’ CI environments. Hijacked maintainer accounts push deceptively named GitHub Actions workflows that scan current files and Git history for cloud, package-registry and AI-provider keys. Further waves appeared on October 10 and 12, materially expanding the campaign described previously (earlier coverage). The Hacker News summarizes GitGuardian’s findings. · Oct 16 · observed · via stolen credentials · Cloud, CI/CD & Supply Chain
  • GhostAction is back: Socket counts 500+ GitHub accounts that committed a malicious workflow to tens of thousands of repos since 7 October, while StepSecurity traced two high-profile maintainer accounts — pyxel author Takashi Kitao (27 repos from 13:20 UTC) and athenadriver's Henry Wu (318 repos in a 16-minute burst, 21:10–21:26 UTC). The workflow (security-audit.yml / github_actions_security.yml) triggers on any push or tag, checks out with fetch-depth: 0, and curls named Actions secrets plus AWS, Anthropic, OpenAI, OpenRouter, GitHub and GitLab keys found anywhere in working tree or git history to 193.32.204[.]199 over plain HTTP. Initial access is assessed as leaked PATs from infostealer logs; the 2025 round exfiltrated 3,325 secrets from 817 repos across 327 users (The Hacker News). · Oct 10 · observed · via stolen credentials · Supply Chain & CI/CD