GhostAction

Software supply chain campaign and its unnamed operator, first reported by GitGuardian in September 2025: malicious GitHub Actions workflows named "Github Actions Security" injected into compromised repositories exfiltrated CI/CD secrets, with 3,325 secrets stolen from 817 repositories. In October 2026 OpenSourceMalware reported a renewed wave and a second stage that no longer needs a CI runner:… Source: MISP

Relationships come from co-occurrence in the news, not attribution. Sources: MISP galaxy and SigmaHQ.