GhostAction: When GitHub Becomes a Software Supply Chain Weapon

Executive Summary Between August 31 and October 21, 2026, the GhostAction campaign used nearly 2,000 hijacked GitHub accounts to plant malicious workflows in tens of thousands of repositories (more th