Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
15 IOCs
GhostAction Attack Escalates By Targeting GitHub Users
Malware Families
Excerpt
GhostAction Attack Escalates By Targeting GitHub Users | OpenSourceMalware BLOG GhostAction Attack Escalates By Targeting GitHub Users OSM has identified a new evolution of the GhostAction attack, which targets GitHub users via malicious CI workflow files and worm-like behaviour By c0a15726-c5b1-4b0d-85e6-fe15553df9e2 · 2026-10-09T23:55:53.631Z OpenSourceMalware has identified a new stage in the ongoing "GhostAction" malicious campaign that GitGuardian originally…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability(3)
Victim
Indicators of Compromise
Open the mindmap →15 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | 7fbd40446a82c77b23432c6ab73bd8595c98e90e4f4a473198b4d1256f3e8c4b | Medium | Score 53/100 | First seen |
| URL | https://my-github.com/SDRVuhYw | High | Score 63/100 | First seen |
| Domain | sncf.carte-avantage.com | High | Score 58/100 | First seen |
| URL | http://193.32.204.199 | High | Score 64/100 | First seen |
| Domain | carte-avantage.com | High | Score 58/100 | First seen |
| Domain | gitlab.my-gitlab.com | High | Score 58/100 | First seen |
| Domain | bold-dhawan.45-139-104-115.plesk.page | High | Score 58/100 | First seen |
| IP | 18.167.164.26 | High | Score 58/100 | First seen |
| IP | 45.139.104.115 | High | Score 58/100 | First seen |
| IP | 170.39.218.2 | High | Score 58/100 | First seen |
| Domain | objective-hopper.45-139-104-115.plesk.page | High | Score 58/100 | First seen |
| Domain | my-gitlab.com | High | Score 63/100 | First seen |
| URL | http://193.32.204.199/c/ | High | Score 58/100 | First seen |
| URL | http://193.32.204.199:3000/api/workflow/receive?inj= | High | Score 58/100 | First seen |
| URL | http://193.32.204.199/?c=monami | High | Score 63/100 | First seen |
IOC Relationship Graph
Building graph…