193[.]32[.]204[.]199

GhostAction Returns: Malicious “Security Audit” Workflows Now Mine Credentials from Entire Git Histories

New GhostAction Wave Hits Hundreds of Repos, Expanding Beyond CI/CD Secrets to Cloud Credentials

Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories