Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
2 IOCs
New GhostAction Wave Hits Hundreds of Repos, Expanding Beyond CI/CD Secrets to Cloud Credentials
Excerpt
Socket analyzed an October 8, 2026 burst of the GhostAction campaign in which two compromised maintainer accounts committed a workflow named security-audit.yml into 346 repositories — among them uber/athenadriver and the 18,420-star kitao/pyxel — merging GitHub Actions secret theft with a new sweep of the working tree and full git history for cloud credentials, posted in cleartext to a single hardcoded IP address. On October 8, 2026, two GitHub accounts — henrywoo and kitao —…
Read the original report →Diamond Model
Adversary
Infrastructure(2)
Capability
Victim
Indicators of Compromise
Open the mindmap →2 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| URL | http://193.32.204.199 | High | Score 64/100 | First seen |
| URL | http://193.32.204.199/?c=monami | High | Score 63/100 | First seen |
IOC Relationship Graph
Building graph…