Unverified50% confidenceEventExact time
The Gheist campaign uses stolen GitHub tokens to implant malicious GitHub Actions workflow files in target repositories in order to steal data.
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
10/25/2026
First Seen
Valid until: 1/23/2027
Sources
Related Entities
Related Claims
Unverified2022年，GitHub曾披露攻击者利用被盗的OAuth令牌访问了多个组织的私有仓库，影响了包括npm在内的多个重要项目79% similarUnverifiedA team successfully stole nearly 4,000 internal GitHub repositories through a malicious VS Code extension.78% similarUnverifiedA compromised GitHub account may be used to inject malicious commits into open-source projects, constituting a software supply chain attack.77% similarUnverifiedAccording to The Hacker News, Operation GhostAction discovered by GitGuardian affected about 1,900 GitHub accounts and more than 30,000 repositories, with payloads attempting to steal 3,174 secrets from CI environments, including npm, PyPI, DockerHub, and AI vendor credentials.73% similarUnverifiedGitHub's bug bounty program runs on the HackerOne platform.72% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1097742API
curl https://kongchang.com/api/v1/knowledge/claims/1097742MCP
get_claim(id=1097742)