New GhostAction Attack Compromises Hundreds of GitHub Repos to Steal Secrets

A new GhostAction campaign has compromised 346 GitHub repositories after threat actors used two hijacked maintainer accounts to add a fake “security audit” workflow designed to steal CI/CD secrets, cloud keys, API tokens, and credentials stored in source-code history. Security firm Socket reported that the October 8 activity affected repositories connected to the GitHub accounts henrywoo and kitao. The targets include Uber’s uber/athenadriver repository and the popular kitao/pyxel project, which has more than 18,000 GitHub stars. The malicious file, .github/workflows/security-audit.yml, was added through commits named “Add security audit workflow” and “Update security audit workflow.” The campaign shows how a stolen...

Read the full article at the source.