The credential-theft campaign known as GhostAction has ramped up, targeting more than 30,000 repositories across 3,000 users and organizations.
The spike, according to GitGuardian, was observed on October 8 and 9, 2026.
« This resulted from compromising the GitHub accounts of about 1,900 users. It attempted to extract 3,174 secrets from public repositories’ CI, » security researchers Gaetan