Post

🚨 A new GhostAction wave has hit hundreds of GitHub repos, including Uber’s athenadriver and Pyxel. Attackers used compromised maintainer accounts to plant fake “security audit” workflows that steal GitHub Actions secrets.

9/10/26, 1:10 pm7 reposts8 likes

Sarah Gooding

@sarahgooding.bsky.social

cc: @campuscodi.risky.biz @darkreading.bsky.social @dangoodin.bsky.social @thehackernews.bsky.social @bleepingcomputer.com

Socket

@socket.dev

The payload now also scans source code and full git history for cloud and AI credentials, including secrets deleted from current files. It captures nearby lines around AWS key IDs to find the corresponding secret keys. socket.dev/blog/ghostac...