Zero Radar
← feed
HighSecurity incidentupdated 28 Oct 2026, 22:08 UTC

GitHub supply chain attack campaign (GhostAction) left attackers lurking in developer accounts

Attackers used a trick to get into software projects hosted on GitHub, and some of them are still inside. If your team builds or ships code there, someone unwanted may still have access.

Attacks reported (Dark Reading)1 source, unconfirmed
SeverityHighSecurity incident
Being exploited?ReportedBy Dark Reading, not officially confirmed yet
What to doCheck exposureReview your GitHub audit logs and rotate any tokens or secrets that developers or pipelines could have exposed.
How sure is this?1 source, unconfirmedOnly one publisher so far, details may change

How the attack works simplified

  1. 1Campaign launchedGhostAction targets GitHub projects
  2. 2Projects compromisedAttackers gain access to repositories
  3. 3Developer endpointsCampaign shifts toward developer machines
  4. 4Cloud accessAttackers pursue cloud credentials
  5. 5Attackers persistAccess remains after the wave fizzles
  6. ResultAttackers keep access inside developer environments

What happened

A supply chain attack campaign named GhostAction targeted GitHub-hosted projects, with attackers shifting toward developer endpoints and cloud access. The material does not specify the exact vulnerability or affected components.

Why it is dangerous: Attackers with access to code pipelines and cloud credentials can inject malicious code into software that others trust and install, and can keep access after the initial wave ends. Developers and organizations using GitHub Actions or similar CI systems are at risk.

Are you affected?

You are affected if your organization uses GitHub repositories and automation tied to developer accounts or cloud access that may have been compromised by the GhostAction campaign.

Unknown - the material does not list specific products, versions or configurations.

What to do

  1. Review GitHub audit logs and recent workflow changes for unexpected activity
  2. Rotate credentials, tokens and secrets used by developer accounts and CI pipelines
  3. Check developer endpoints and cloud access for signs of persistence and remove unknown access

Timeline

  1. 28 Oct 2026, 19:39 UTC
    Publicly disclosed
  2. 28 Oct 2026, 19:39 UTC
    Reported by Dark Reading · Dark Reading
  3. 28 Oct 2026, 22:08 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Security press established security newsrooms

Technical details

ID
ZR-89379326
Disclosed
28 Oct 2026, 19:39 UTC
On Zero Radar
28 Oct 2026, 22:08 UTC (3 h after disclosure)
Last change
28 Oct 2026, 22:08 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

GitHub supply chain attack campaign (GhostAction) left attackers lurking in developer accounts · Zero Radar