GhostAction campaign (Campaign)

GitGuardian reported the 'GhostAction' campaign where attackers who obtained write access to repositories added malicious GitHub Actions workflows (commonly named "Github Actions Security") that exfiltrate CI/CD secrets via HTTP POST to an attacker-controlled endpoint (bold-dhawan.45-139-104-115.plesk.page / 45.139.104.115). The campaign affected 327 users, 817 repositories, and 3,325 secrets (npm, PyPI, Docker Hub, GitHub tokens, cloud keys); stolen tokens enable trojaned package/image publishes and cloud keys allow pivoting, persistence, and potential escalation until workflows are removed and secrets rotated.