GhostAction Hackers Compromise 500+ GitHub Accounts to Steal Cloud and AI API Credentials

What happened

A new GhostAction campaign has expanded to more than 500 compromised GitHub accounts and has injected malicious workflows into tens of thousands of repositories since October 7, 2026. Socket’s October 9 update describes a credential theft operation targeting GitHub Actions secrets, cloud credentials, and AI service API (the interface one piece of software uses to talk to another) keys embedded in source code and repository history. […] The post GhostAction Hackers Compromise 500+ GitHub Accounts to Steal Cloud and AI API Credentials appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .