The GhostAction campaign, a notorious credential-theft operation, has intensified its efforts by targeting over 30,000 repositories belonging to 3,000 users and organizations. According to security firm GitGuardian, this surge in activity was detected on October 8 and 9, 2026. The attackers compromised approximately 1,900 GitHub accounts, aiming to extract 3,174 secrets from public repositories' continuous integration processes. GhostAction, first identified in September 2025, is a supply chain attack campaign that targets developer infrastructure on GitHub. It involves threat actors infiltrating legitimate developer accounts to inject harmful GitHub Actions automation workflows into software repositories. Attackers typically gain write access to repositories by using stolen Personal Access Tokens or credentials sourced from infostealer logs. With access, they introduce a malicious workflow file using misleading names like "security-audit.yml" or "github_actions_security.yml". The goal is to steal secrets related to continuous integration and continuous deployment, cloud credentials, package registry tokens, and artificial intelligence provider API keys. Since August 31, 2026, a new wave of GhostAction has been observed, deploying a malicious workflow to hundreds of repositories. This wave appears more experimental and evolves over time. The initial version of the payload included a git history secret-scanning feature, while subsequent versions enhanced this capability by capturing context around detected AWS key IDs and supporting secret context retrieval. GitGuardian reports that the payload was deployed in phases, initially affecting 160 known victims and then spreading to 28,000 new repositories within minutes on October 8 and 9. Although GitHub has since blocked the malicious workflow from executing, preventing further secret extraction, the attack underlines the importance of rotating credentials. Some victims had previously been compromised during earlier waves, suggesting that unrotated secrets were exploited.