GhostAction Campaign Compromises 790 GitHub Repositories via Malicious Workflows
Researchers at OpenSourceMalware have counted 790 GitHub repositories containing malicious workflows introduced by the GhostAction campaign. The tally covers publicly validated and recoverable repositories observed up to October 9.
The campaign abuses trusted developer accounts. Once an attacker gains write access to a maintainer’s repositories, they add a workflow that executes on every code push or manual trigger. This workflow exposes any secrets available to GitHub Actions and searches repository files for credential-like strings, including AWS access keys and tokens for GitHub, GitLab, Google, Slack, SendGrid, OpenAI, Anthropic, and OpenRouter.
The workflow also clones the complete Git history, allowing attackers to recover credentials that were later removed from current code but remain visible in older commits. In some cases it extracts surrounding lines near AWS key identifiers that may contain the corresponding secret. All collected data is transmitted in plaintext to attacker-controlled infrastructure.
The reach of the campaign extends across active projects, forks, and long-inactive repositories, indicating automated discovery of every repository the compromised accounts could modify. A separate surge on October 8 affected 346 repositories tied to two maintainer accounts, among them a project belonging to Uber.
Simply deleting the malicious workflow file does not resolve the incident. Any successful execution has already exposed credentials, and removal does not revoke stolen tokens or erase secrets present in historical commits. Recommended actions include revoking the affected account credentials, rotating every secret the workflow could access, and reviewing releases and cloud activity from the relevant period.
Related articles
SberTech Launches Platform V Orchestrator for Security Services to Scan Software Before Corporate Deployment
SberTech has announced the launch of a new direction focused on analyzing the security of software prior to its integration into corporate infrastructures. The initiative is built around the company's own Laboratory for Software Verification and the technological platform Platform V Orchestrator for Security Services. This platform combines components for working with both built-in and external analysis tools, enabling checks of digital artifacts, control over software composition and changes, and detection of vulnerabilities, hidden threats, and defects in source code and repositories. SberTech aims to replace fragmented checks and manual result processing with a single managed process, allowing scaled verification without proportional team growth. The move responds to the adoption of hundreds of products from various vendors, widespread use of open-source components, and rising attacks on software supply chains. Primary customers include banks, industrial enterprises, telecom operators, energy companies, and the public sector. The solution is offered as a standalone product that supports on-premises deployment and operation in isolated environments such as private clouds and dedicated data processing contours.
NEC Subcontractor Suffers Cyber Attack Leading to Customer System Disruptions and Personal Data Leak
NEC disclosed that a subcontractor handling system development and maintenance was compromised in a cyber attack during late September 2026. Attackers stole legitimate account credentials and used them to access multiple customer environments from the subcontractor's systems. The intrusion resulted in server files being encrypted, rendering customer systems inoperable. Additional files containing personal information and system details were exfiltrated from a shared cloud storage platform used for coordination between NEC, the subcontractor, and customers. Affected customers have been notified individually, with further details on compromised personal data to be provided as they become available. The incident highlights risks associated with third-party vendor access in IT supply chains.
OVHcloud CLI Compromised: Infostealer Distributed Through Hijacked GitHub Releases for 25 Minutes
On October 19, the official OVHcloud CLI tool was compromised when an attacker used a hijacked developer account to replace binaries in five existing releases from v0.11.0 to v0.15.0. The attack lasted from 15:47 to 16:12 Moscow time, with the infostealer targeting API keys, SSH keys, and other secrets stored on developer and CI machines. The malicious binaries were uploaded directly via the GitHub Releases API, and the checksums.txt file was also replaced to match the tampered archives. Only users who had hardcoded the original SHA-256 hash in their CI pipelines, such as one customer who opened issue #300, detected the tampering when builds failed. The compromised account HassenBF had been infected with GlassWorm malware since March 2025, allowing persistent access until the October attack. OVH responded by deleting the malicious files at 17:21 and releasing v0.16.0 with immutable releases and attestation enabled.
Supply Chain Attacks Target Ledger Hardware Wallets with Evolving Backdoors
Ledger disclosed that sophisticated hardware backdoors discovered in multiple Nano X, Flex, and Stax devices enabled thieves to steal approximately 102 million dollars in cryptocurrency from roughly 315 accounts. The implants, initially found by hardware hacker Joe Grand in devices sold by unauthorized Southeast Asian sellers, have since appeared in units purchased from authorized resellers CryptoBilis and MediaMarkt. Later versions analyzed by Mark Karpeles feature custom flexible PCBs, LTE modules, and antennas engineered to intercept seed phrases and exfiltrate them over cellular networks. Evidence now points to deliberate compromise of the authorized supply chain rather than isolated tampering of returned units. Ledger has urged resellers to purchase only through verified channels and has suspended sales through CryptoBilis pending investigation, while users continue to report additional compromised devices across Europe.