GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories
The Hacker News published a report on October 15, 2026 describing an operation it calls GhostAction, stating that the campaign compromised about 1,900 GitHub accounts and targeted over 30,000 repositories. Those two figures — roughly 1,900 compromised accounts and more than 30,000 targeted repositories — are the substantive claims carried by the source. The item is attributed to The Hacker News and appears under the headline "GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories." The supplied source text contains no further reporting beyond the headline and the account and repository counts. It does not name the actors, describe the technique used to gain access, identify which repositories or organizations were affected, state whether GitHub or any other party responded, or give a timeline for the activity. Because the excerpt is limited to page styling and font declarations, no additional technical indicators, indicators of compromise, or remediation guidance can be drawn from it. The digest therefore stays with the two numbers the source states: about 1,900 compromised GitHub accounts and over 30,000 repositories described as targets.
The source states that roughly 1,900 GitHub accounts were compromised in the GhostAction campaign, which matters to developers whose code and credentials live on the platform.