GhostAction

A campaign dubbed GhostAction is compromising GitHub maintainer accounts and injecting malicious Actions workflows into tens of thousands of repositories. The injected workflows are designed to steal secrets such as API keys, tokens, and other credentials from the affected projects. Security researchers are urging maintainers to audit their workflow files, rotate exposed secrets, and review repository permissions, as the malicious code can run automatically in CI environments where sensitive tokens are routinely available.