GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories

First reported by The Hacker News at · Updated · 2 sources

The credential-theft campaign known as GhostAction has ramped up, targeting more than 30,000 repositories across 3,000 users and organizations. The spike, according to GitGuardian, was observed on October 8 and 9, 2026.

Covered by 2 publishers within 12 hours of the first report.

Summary from The Hacker News.

Reporting2

The Hacker News GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories · info@thehackernews.com (The Hacker News)
The New Stack Hackers hijacked 1,900 GitHub accounts. Then they went after 30,000 repos. · Amanda Caswell