Hackers hijacked 1,900 GitHub accounts. Then they went after 30,000 repos.
Hackers accessed roughly 1,900 GitHub accounts, then used them to slip credential-stealing workflows into more than 30,000 repositories. The malicious The post Hackers hijacked 1,900 GitHub accounts. Then they went after 30,000 repos. appeared first on The New Stack .
Hackers orchestrated a two-phase attack on GitHub, initially compromising roughly 1,900 accounts before leveraging those credentials to infiltrate over 30,000 repositories. The malicious GitHub Actions jobs targeted sensitive information such as CI/CD secrets, cloud access keys, and API keys from AI providers. The GhostAction campaign intensified on October 8 and 9, when attackers targeted around 3,000 users and organizations, attempting to extract 3,174 secrets.
The compromised accounts were likely obtained through stolen developer credentials, possibly sourced from credential dumps, though the initial breach remains unconfirmed. Once inside the repositories, the attackers added disguised workflows with names like security-audit.yml or github_actions_security.yml, which referenced existing secrets to collect credentials when they ran and send them to an attacker-controlled server.
Brief written by urgent.news from The New Stack's own syndicated text. Machine-written — may contain errors; check the original before relying on it.
