GhostAction Supply Chain Attack Targets 30,000 GitHub Repositories

GhostAction Campaign Attack Ki Puri Jankari

Cybersecurity ki duniya me ek naya aur khatarnak mamla samne aaya hai. GhostAction naam ke credential-theft campaign ne digital world me halchal macha di hai. Is campaign ne lagbhag 3,000 users aur organizations ke 30,000 se zyada repositories ko target kiya hai.

Ye bada spike GitGuardian dwara 8 aur 9 October 2026 ko observe kiya gaya tha. Security researchers Gaetan Ferry aur Guillaume Valadon ne bataya ki ye sab lagbhag 1,900 GitHub accounts ke compromise hone ki wajah se hua. Attackers ne public repositories ke CI se 3,174 secrets nikalne ki koshish ki.

GhostAction Campaign Kya Hai?

GhostAction ek supply chain attack campaign hai jo GitHub par developer infrastructure ko target karta hai. Sabse pehle ise September 2025 me discover kiya gaya tha. Isme threat actors legitimate developer accounts ko compromise karte hain aur software repositories me malicious GitHub Actions automation workflows inject karte hain.

Attackers ko repositories ka write access mil jata hai. Wo stolen Personal Access Tokens (PATs) ya infostealer logs aur dumps se harvest kiye gaye credentials ka use karte hain. Hijacked maintainer account ka use karke, wo ek malicious workflow file push karte hain jiska naam deceptive hota hai, jaise ki Security Audit ("security-audit.yml") ya GitHub Actions Security ("github_actions_security.yml").

Attack Ka Main Uddeshya

Is activity ka main goal continuous integration and continuous deployment (CI/CD) secrets, cloud credentials, package registry tokens, aur artificial intelligence (AI) provider API keys ki large-scale theft karna hai. Package registry tokens me jaise npm, PyPI, aur DockerHub shamil hain.

Cybersecurity experts ke anusar, August 31, 2026 se GhostAction ka ek naya wave observe kiya gaya hai. Isme malicious workflow ko saindo repositories me push kiya gaya hai. Ye naya wave pehle wale waves ke mukable zyada experimental aur manual lagta hai, aur iska payload time ke sath evolve ho raha hai.

Payload Me Naye Features

Pehle wale GhostAction payload ke comparison me, is naye payload ke first version me ek git history secret-scanning feature add kiya gaya tha. Socket aur StepSecurity dwara pehle hi bataya gaya tha ki is history-scanning functionality me secret-detection regular expressions hain.

In expressions me AWS key IDs, GitHub aur GitLab tokens, AI-related secrets, aur cloud API keys cover hoti hain. Payload ka second version AWS key ID hit ke around do lines of context bhi capture karta hai. Iska maqsad unhe unke matching secret access keys ke sath pair karna hota hai.

Payload ka third aur final variant git history scan ke dauran secret context retrieve karne me support provide karta hai. GitGuardian ke mutabiq, ye payload multiple phases me deploy kiya gaya tha.

Deployment Aur GitHub Ki Action

Shuru me ise 160 previously observed victims par deploy kiya gaya tha. Phir, iske 20 minute baad, October 8 aur 9 ke beech 28,000 new repositories par deploy kiya gaya. Iske baad October 10 aur 12 ko bhi same payload ke sath naye waves observe kiye gaye the.

Lekin, khushi ki baat ye rahi ki GitHub ne October 9 se hi malicious workflow ko run hone se rokna shuru kar diya tha. Is wajah se baad ke do waves koi bhi secrets extract nahi kar paaye.

Ek interesting baat ye hai ki is naye burst ke victims me kuch aise users bhi shamil the jo September 2025 aur August 2026 ke waves me pehle hi compromise ho chuke the. Ye is baat ka sanket deta hai ki threat actors unrotated secrets par bharosa kar rahe hain taaki wo apna kaam nikal sakein. Developers ko apne secrets regular basis par rotate karte rehna chahiye.