GhostAction Hack Hits 1,900 GitHub Accounts, Targets 30,000 Repos

Cybersecurity 📅 Oct 15, 2026 ✍️ Aamir Raza

Hackers Hit 1,900 GitHub Accounts

A supply-chain attack called GhostAction targeted over 30,000 code repositories to steal secrets, per GitGuardian. LexxWire

The attack spiked on October 8–9, reaching 30,000+ repos across 3,000 users and organizations. LexxWire

Attackers used stolen access tokens to push malicious workflow files named like routine security checks. LexxWire

The goal: grab cloud credentials, npm and PyPI tokens, and AI provider API keys — 3,174 secrets targeted. LexxWire

GitHub began blocking the malicious workflows on October 9. Experts say affected teams must rotate every key. LexxWire