// tag

GhostAction

notes

GhostAction actors distribute credential stealer disguised as font in 94 GitHub repos

1. Executive summary The GhostAction campaign has added a second delivery path: phishing of open-source developers to deliver a credential stealer hidden in a fake

19 Oct 2026 · 8 min read read →

notes

GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories

1. Executive summary A credential-theft campaign tracked as GhostAction compromised the GitHub accounts of about 1,900 users and pushed malicious GitHub Actions workflows into

15 Oct 2026 · 7 min read read →

page 1 of 1