GhostAction plants a credential-stealing workflow in tens of thousands of GitHub repositories

The GhostAction campaign compromises maintainer accounts to push a fake “security” workflow that exfiltrates CI/CD secrets to an attacker-controlled IP. Check your repos for security-audit.yml and github_actions_security.yml, then revoke any affected credentials.