#ghostaction

The workflow was called security-audit.yml, and each copy named the secrets that repository actually used

Socket's latest GhostAction wave commits a credential-stealing GitHub Actions workflow straight to default branches. The payload is reusable, but the attackers read each repository's existing workflows first to learn which secret names to ask for. The October variant also sweeps the full git history.