Open Source

GhostAction Turns GitHub Workflows Into Credential Traps

A renewed GhostAction campaign is planting fake security-audit workflows in GitHub repositories to steal Actions secrets and credentials buried in source history.