GhostAction Uses GitHub Actions to Steal Cloud and AI Credentials
What changed · following since Oct 10 Oct 20 — GhostAction has added GitHub-themed phishing and a VS Code-triggered credential stealer disguised as a font file, with 94 repositories carrying the second stage.
GhostAction has evolved from workflow injection into
Built from 5 signals across 3 sources · 515 items reviewed