GitHub supply chain cyberattacks

Security researchers have identified large-scale cyberattacks targeting the GitHub developer platform through the manipulation of software repositories and automated workflows.

Initial reports from Socket indicated that since October 7, 2026, over 500 compromised accounts were used to inject malicious code into tens of thousands of repositories via manipulated GitHub Actions workflows. The primary objective of these attacks was to steal sensitive credentials, such as cloud infrastructure access keys and AI service keys, by transmitting data to a hardcoded IP address.

Subsequent findings by Wiz Research identified a specific campaign named ‘Gheist’ that had been active since September 15, 2026. This campaign utilized stolen tokens to commit a ‘sync-check’ workflow to accessible repositories. This workflow was designed to print repository secrets into workflow logs, which attackers then downloaded via the GitHub API before deleting the runs to evade detection. While GitHub implemented controls for public repositories, the campaign successfully targeted private and enterprise environments by using GitHub’s own API for exfiltration, bypassing traditional security measures that look for external outbound connections.