Hackers Inject Malicious Workflows Into 790 GitHub Repos
The GhostAction campaign successfully compromised hundreds of repositories by taking over maintainer accounts.
Updated on Oct. 20, 2026 in Cybersecurity
Live Poll
Do you feel confident that your own online accounts are secure against sophisticated credential-theft hackers?
Hackers known as GhostAction have injected malicious GitHub Actions workflows into 790 separate repositories. The unauthorized activity was completed by October 9, 2026.
Why it matters
The attack highlights the risks of automated software supply chain exploitation. By leveraging account takeovers, attackers can compromise numerous projects simultaneously without needing to target users directly.
The attackers targeted 790 repositories through account-takeover methods that allowed them to inject malicious workflows. This follows a 2025 operation by the same group that impacted 817 repositories and resulted in 3,325 stolen secrets.
The players
GhostAction
GhostAction is a group of hackers known for targeting software supply chains through repository account takeovers.
GitGuardian
GitGuardian is a cybersecurity firm that monitors and documents threats targeting software development platforms and code repositories.
GitHub
GitHub is a global platform used by developers to host and review code, manage projects, and build software.
The details
Attackers gain write access to repositories by compromising maintainer accounts. Once inside, they inject malicious workflows to automate unauthorized actions within the GitHub ecosystem.
Timeline
In 2025, GitGuardian documented the initial GhostAction operation.
On October 9, 2026, the attackers completed the injection into 790 repositories.
The Tech Race
This activity reflects a broader trend of supply chain attacks targeting developer workflows to harvest secrets at scale. It positions modern CI/CD platforms as critical frontiers in the ongoing arms race between automated malicious injections and repository security protocols.
Developers and maintainers should immediately review their repository workflow files for unauthorized changes or suspicious script additions. Implementing stricter account security, such as mandatory multi-factor authentication, is essential to prevent similar takeover-based injections.
The takeaway
Security teams should prioritize auditing automated workflow permissions to limit the impact of compromised accounts. Proactive monitoring for unusual commit activity remains the most effective defense against bulk repository injections.
Further reading
Learn more about evolving digital threats in our Cybersecurity section.
Live Poll
Do you feel confident that your own online accounts are secure against sophisticated credential-theft hackers?
