Skip to content
T threat.cafe

Tag

#incident-runbook

1 post

  1. · Solene Beaumont-Adjei · Incident response · on threat.cafe

    Security audit workflows that steal your AI keys: GhostAction's October wave and a 10-minute repo check

    From 7 October 2026, stolen maintainer credentials pushed fake "security audit" GitHub workflows that harvest CI secrets and committed keys, including Anthropic, OpenAI and OpenRouter keys. Here is a read-only check and a runbook.