Socket identified more than 500 hijacked GitHub accounts that have targeted tens of thousands of repositories since October 7. The campaign has impacted organization-owned repositories and specific projects including Pyxel and Uber's athenadriver, often reaching them through compromised contributors.
Tuesday, October 20, 2026
Story
500 Hijacked GitHub Accounts Target Tens of Thousands of Repos in New Wave
Cybersecurity11 days ago
Attackers have embedded malicious scripts into software libraries by compromising the accounts of trusted contributors to harvest sensitive credentials. These "GhostAction" workflows are disguised as legitimate security audits, allowing intruders to steal AWS keys, API tokens, and other secrets from Git history without alerting administrators.
Looking for more context or analysis?
Tilt chat provides reliable, tailored insights, alerts, and automations.