GhostAction Hackers Compromise 500+ GitHub Accounts to Steal Cloud and AI API Credentials

GhostAction is an active credential-theft campaign that has compromised 500+ GitHub accounts and injected malicious workflows (e.g., .github/workflows/security-audit.yml) into thousands of repositories since October 7, 2026; the workflows harvest current and historical secrets (including cloud, package registry, and AI API keys) by checking out full repo history and exfiltrating collected data to an attacker-controlled IP, and the report provides indicators and mitigation steps such as removing injected workflows, rotating exposed credentials, enabling secret scanning, and auditing affected releases and CloudTrail activity.