TLDR Tech / News
GhostAction Campaign Steals Credentials Via Compromised Git Repositories
The GhostAction threat actor group has resumed its credential-stealing activities, compromising accounts of prominent open-source developers to distribute a malicious workflow. This workflow targets cloud, AI, and SaaS credentials by extracting GitHub Actions secrets, working tree files, and complete git histories. Security researchers from StepSecurity have verified that at least one repository experienced successful data exfiltration, advising developers to consider repositories with this workflow fully compromised.
Read the full story