GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories
Summary
A credential-theft campaign dubbed GhostAction has significantly increased its activity, targeting over 30,000 repositories belonging to approximately 3,000 users and organizations. This surge is attributed to the compromise of around 1,900 GitHub accounts, from which attackers attempted to exfiltrate secrets from CI/CD pipelines within public repositories.
IFF Assessment
The GhostAction campaign's success in compromising numerous GitHub accounts and targeting repositories indicates a significant threat to code integrity and potentially sensitive information, posing a risk to defenders.
Defender Context
This incident highlights the ongoing threat of credential theft targeting code repositories, emphasizing the need for robust authentication mechanisms like multi-factor authentication and vigilant monitoring for unauthorized access. Defenders should be aware of campaigns targeting CI/CD pipelines, as compromised secrets can lead to further downstream compromises.