GhostAction

Software supply chain campaign and its unnamed operator, first reported by GitGuardian in September 2025: malicious GitHub Actions workflows named "Github Actions Security" injected into compromised repositories exfiltrated CI/CD secrets, with 3,325 secrets stolen from 817 repositories. In October 2026 OpenSourceMalware reported a renewed wave and a second stage that no longer needs a CI runner:… Fuente: MISP

Relaciones por coaparición en noticias, no atribución. Fuentes: MISP galaxy y SigmaHQ.