aiqbench analysis
This campaign exploits GitHub Actions workflows to scan repository histories for exposed AI API keys and cloud credentials, specifically targeting services like OpenAI and Anthropic. The threat is significant because attackers leverage trusted developer accounts to exfiltrate secrets from both active codebases and historical commits via plain HTTP transfers. While the primary vector is a general supply chain attack, the specific harvesting of model provider tokens makes this a critical vulnerability for AI infrastructure security.
Hackers Hijack 790 GitHub Repositories to Steal Cloud Credentials and AI API Keys
A campaign called GhostAction has placed malicious GitHub Actions workflows in 790 repositories, putting cloud credentials, software-publishing tokens, and AI service keys at risk. The total is OpenSourceMalware’s count of publicly recoverable, validated repositories through October 9, 2026; it is not a claim that every repository leaked credentials or suffered confirmed misuse. The campaign abuses […] The post Hackers Hijack 790 GitHub Repositories to Steal Cloud Credentials and AI API Keys appeared first on Cyber Security News.
A campaign called GhostAction has placed malicious GitHub Actions workflows in 790 repositories, putting cloud credentials, software-publishing tokens, and AI service keys at risk. The total is OpenSourceMalware’s count of publicly recoverable, validated repositories through October 9, 2026; it is not a claim that every repository leaked credentials or suffered confirmed misuse. The campaign abuses trusted developer accounts. Once an attacker can write to a maintainer’s repositories, they can add a workflow that…
Excerpt shown under the publisher's RSS terms · 73 words · full text and figures are on the publisher's site
Related coverage
Hackers Hijack OVHcloud GitHub Releases to Distribute Secret-Stealing Malware
Cybersecurity News · Oct 20, 2026
Hackers Abuse GitHub Actions to Exploit cPanel and WHM Servers and Steal Cloud Credentials
Cybersecurity News · Jul 23, 2026
Weekly Cyber Security Newsletter Bulletin – Entra ID RCE, Claude Code Ransomware, T-Mobile Cable, Azure Credential Theft +20 Stories
Cybersecurity News · Aug 23, 2026
Hackers Don’t Need to Break Into the Cloud When They Can Steal the Keys
Cybersecurity News · Sep 28, 2026