{
  "id": 14794422,
  "title": "Hackers hijacked 1,900 GitHub accounts. Then they went after 30,000 repos.",
  "url": "https://urgent.news/2026/10/15/hackers-hijacked-1-900-github-accounts-then-they-went-after-30-000",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-15T21:13:01.000Z",
  "source": {
    "name": "The New Stack",
    "slug": "the-new-stack",
    "url": "https://thenewstack.io/hackers-hijacked-1900-github-accounts-then-they-went-after-30000-repos/"
  },
  "original_language": "en",
  "account": null,
  "summary": "Hackers orchestrated a two-phase attack on GitHub, initially compromising roughly 1,900 accounts before leveraging those credentials to infiltrate over 30,000 repositories. The malicious GitHub Actions jobs targeted sensitive information such as CI/CD secrets, cloud access keys, and API keys from AI providers. The GhostAction campaign intensified on October 8 and 9, when attackers targeted around 3,000 users and organizations, attempting to extract 3,174 secrets. The compromised accounts were likely obtained through stolen developer credentials, possibly sourced from credential dumps, though the initial breach remains unconfirmed. Once inside the repositories, the attackers added disguised workflows with names like security-audit.yml or github_actions_security.yml, which referenced existing secrets to collect credentials when they ran and send them to an attacker-controlled server.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}