Act
active
GhostAction Steals CI Secrets from 30K+ GitHub Repositories
- Engineer — Act: Active campaign extracted CI secrets from public repositories on October 8-9; audit all public repos for exposed secrets in CI config files and rotate GitHub PATs and any credentials stored in workflows immediately.
- SOC/IR — Act: Campaign has a tight activity window (Oct 8-9); hunt for unauthorized GitHub OAuth activity, anomalous CI/CD pipeline triggers, and unexpected secret-access events in organizational repos since that date.
- Leader — Act: Approximately 1,900 accounts compromised at scale warrants a same-week check: confirm with engineering whether any organizational GitHub accounts were among those affected and request an audit of CI secret exposure before this surfaces as a supply-chain incident.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.