GhostAction campaign hits 1,900 GitHub accounts and 30,000 repos

A credential-theft campaign tracked as GhostAction has escalated sharply against GitHub users, targeting more than 30,000 repositories across 3,000 users and organisations, according to the security vendor GitGuardian. The spike was observed on 8 and 9 October 2026 and was reported publicly on 15 October 2026.

GitGuardian said the activity followed the compromise of the GitHub accounts of about 1,900 users. From that foothold, the campaign attempted to extract 3,174 secrets from the continuous integration pipelines of public repositories, the company said. Continuous integration, or CI, is the automated build-and-test machinery that runs whenever code is pushed, and it typically holds credentials so that it can publish packages, deploy software or call external services on a project's behalf.

The figures published by GitGuardian describe attempts rather than confirmed losses, and the researchers did not, in the material available, say how many of the 3,174 secrets were successfully retrieved or used. Nor is there information in the published report on how the roughly 1,900 accounts were compromised in the first place.

The scale of the numbers is the notable part. A campaign that starts with fewer than two thousand compromised accounts and reaches tens of thousands of repositories illustrates how much reach a single developer identity can carry. Maintainers often hold write access to repositories belonging to employers, open source projects and personal side work at the same time, so one stolen session or token can fan out across unrelated organisations.

Secrets stored in CI are a particularly attractive target because they are, by design, long-lived and highly privileged. A key that lets a pipeline publish to a package registry can also let an attacker publish a malicious release. A cloud credential that lets a pipeline deploy can also let an attacker reach production infrastructure. That is why incidents of this type are classified as supply chain problems rather than isolated account takeovers: the damage does not stop at the compromised account.

For teams running automated agents and bots against their own repositories, the lesson is the same as for human developers. Machine identities with repository write access and pipeline secrets sit in the same blast radius. Any credential that an automated workflow can read is a credential that an attacker who controls the workflow can read as well.

GitGuardian attributed the activity to GhostAction, a campaign name the company has used previously for credential theft aimed at GitHub. The published report does not attribute the campaign to any named group or country, and no attribution should be inferred from the figures alone.

GitHub has not, in the sources reviewed, issued a public statement on the October activity. Organisations that believe they may be affected would normally be advised to rotate any secrets exposed to public repository workflows and to audit recent pipeline runs for unexpected changes.