GhostAction Never Stopped: 1,900 Accounts, 30,000 Repos, and a Year of Stolen Keys

The GitHub Actions supply chain campaign that never stopped - and why AI API keys made it much more valuable