Socket on Mythryl: “Update: Socket has identified more than 500 GitHub accounts that…”

Update: Socket has identified more than 500 GitHub accounts that committed the malicious GhostAction workflow to tens of thousands of repositories since October 7, including organization-owned repositories reached through compromised contributors.

Socket@socket.dev

🚨 A new GhostAction wave has hit hundreds of GitHub repos, including Uber’s athenadriver and Pyxel. Attackers used compromised maintainer accounts to plant fake “security audit” workflows that steal GitHub Actions secrets.

9/10/26, 6:35 pm1 repost3 likes

Post