# GhostAction Campaign Compromises Hundreds of GitHub Repositories

*Published October 21, 2026*
*Source: [https://cybersecuritynews.com/hackers-hijack-790-github-repositories/](https://cybersecuritynews.com/hackers-hijack-790-github-repositories/)*

## Executive Summary

The GhostAction campaign has infiltrated 790 GitHub repositories, compromising sensitive information like cloud credentials and AI API keys through malicious workflows. Security teams must preserve evidence, revoke compromised credentials, and rotate exposed secrets to mitigate the impact.

## Article

A recent cybersecurity threat, identified as the GhostAction campaign, has compromised 790 GitHub repositories by embedding malicious workflows. These workflows have been designed to extract sensitive information such as cloud credentials, software-publishing tokens, and AI service keys. The campaign was uncovered by researchers at OpenSourceMalware, who were assisting a maintainer of a malicious PyPI package named claudecord. The researchers traced malicious activities across numerous repositories.

The attack leverages trusted developer accounts to insert workflows that activate during code pushes or manual executions. These workflows access GitHub Actions secrets and hunt for credential-like strings within files and Git history. This includes AWS keys and tokens for various services like GitHub, GitLab, Google, and OpenAI. The collected data is then transmitted to attacker-controlled servers, disguised as routine build traffic, making it difficult to detect without thorough inspection of workflow changes and network activity.

GitGuardian reported 772 affected repositories between August and September 2026, while OpenSourceMalware's review indicated 790 compromised repositories by October 9. Additionally, a burst of activity was noted across 346 repositories linked to two compromised accounts on October 8. This burst affected repositories from active projects to long-dormant ones, hinting at automated detection of accessible repositories by compromised accounts.

To combat such threats, security teams are advised to preserve workflow files, logs, commits, and audit records. They should revoke compromised credentials and rotate secrets accessible by the malicious workflows. Monitoring package releases, deployments, and cloud activities during the affected period is crucial. GitHub recommends limiting access privileges, reviewing workflow codes, and rotating exposed secrets to enhance security. Additionally, defenders should be aware of suspicious domains like my-github[.]com, which is linked to this campaign's infrastructure.