Post

Socket
@socket.dev

🚨 A new GhostAction wave has hit hundreds of GitHub repos, including Uber’s athenadriver and Pyxel. Attackers used compromised maintainer accounts to plant fake “security audit” workflows that steal GitHub Actions secrets.

Socket
@socket.dev

The payload now also scans source code and full git history for cloud and AI credentials, including secrets deleted from current files. It captures nearby lines around AWS key IDs to find the corresponding secret keys. socket.dev/blog/ghostac...

0 reposts3 likes

No replies yet.