Cybersecurity News
Filters
Filtered by category: Cybersecurity News, tag: github actions × Clear
Hackers Hijack 790 GitHub Repositories to Steal Cloud Credentials and AI API Keys
Matched: Claude, OpenAI
A campaign called GhostAction has compromised at least 790 GitHub repositories by injecting malicious Actions workflows into trusted developer accounts. The workflows scan repository files and Git history for credentials including AWS keys and tokens for OpenAI, Anthropic, GitHub, and others, then exfiltrate findings to attacker-controlled infrastructure. Removing the workflow is insufficient; affected teams must revoke tokens and rotate all secrets the workflow could have accessed.