#ParsedReport #CompletenessLow
09-10-2026

New GhostAction Wave Hits Hundreds of Repos, Expanding Beyond CI/CD Secrets to Cloud Credentials

https://socket.dev/blog/ghostaction-cloud-credentials

Report completeness: Low

Actors/Campaigns:
Ghostaction

Threats:
Supply_chain_technique

Victims:
Github repositories, Software supply chain, Cloud credential holders, Ai service credential holders

TTPs:
Tactics: 2
Technics: 0

ChatGPT TTPs:
do not use without manual check
T1005, T1059.004, T1071.001, T1078, T1119, T1552.001

IOCs:
Url: 2
IP: 1
Domain: 0
Hash: 0
Email: 0
BrowserExtension: 0

Soft:
curl, Anthropic, OpenAI, Slack, SendGrid

Languages:
rust, python

Links:
https://github.com/henrywoo
https://github.com/kitao