Content Quality: Clear News structure (Overview, mechanism, safeguard scope, payload evolution, overlaps, recommendations, unknowns). 981 words by body count (News range 400-1200). Every claim is attributed to Wiz or The Hacker News; neutral tone; no person is blamed or named; victims are not named beyond the sources.
Source Verification: Read all four snapshots (source-0..3.html.gz, gunzipped, tags stripped) and re-fetched all four live via WebFetch (live results consistent, cross-checked against raw snapshot text). source-0 Wiz (Oct 25, Rami McCarthy, Hila Ramati): confirms tracking since Sept 15, 13,500+ branches from 850+ accounts 'ranging from personal projects to enterprise organizations' private repositories', naming ('The tool's API requests carry the user agent gheist, which gives the campaign its name' - Wiz tracks it as Gheist, so Wiz coined the name and the article says so), branch ci-sync-+6 chars, sync-check.yml, 'ci: sync config', unsigned commit, env | base32 -w 120 and toJSON(secrets) piped to base32, the three-reasons list (verbatim quote 'GitHub masks secret values in logs only when they appear verbatim. A base32-encoded secret doesn't match, so it prints in full.' matches, with the article's capitalization of 'GitHub' preserved), permissions: {}, environment matrix, log download via API and deletion seconds later, no attacker domain, Tool A/B, Sept 28, Oct 19 self-hosted job (31 token formats, Terraform state, shell history, 'buggy'), approval hold since July 28 with every public run checked at action_required ('The control worked, and the malicious payloads never ran.' verbatim), hold not applying to private repos or GHES, audit logs and CloudTrail wording, Oct 6 391 accounts/1,461 repos/610 branches, 57 Megalodon (May), PolinRider described as DPRK-linked, Trivy March, 2/3 accounts gone as of Oct 24 and reported to GitHub, GhostAction distinct with different workflow files, hunt/respond/harden advice, quote 'Deleting the run or the branch doesn't undo the exposure.' Title claim 'Succeeding in Private Repositories' is an attributed Wiz claim ('Wiz Says'); Wiz: 'we've observed successful exploitation and follow-on activity in private repositories and GitHub enterprise environments'. source-1 The Hacker News (Swati Khandelwal, Oct 26): confirms 'Wiz's analysis does not say where those credentials came from or who used them' and 'does not say how many organizations had secrets exposed', Wiz reports no successful run of the self-hosted job, the quote of GitHub's hold scope, and public runs still awaiting approval. Article attributes each of these to THN correctly. source-2 GitHub docs: both quotes verbatim ('Because there are multiple ways a secret value can be transformed, automatic redaction is not guaranteed.'; 'Any user with write access to your repository has read access to all secrets configured in your repository.'). source-3 GitHub changelog (July 28, 2026): 'a repository collaborator with write access reviews and approves it' and 'This protection currently applies to public repositories on github.com only. GitHub Enterprise Server doesn't add this protection at this time.' verbatim; article paraphrase ('does not have the protection at this time') accurate. The sources say nothing about whether the hold stops first-time contributors or new tokens, and the article makes no such claim. The Hacker News's mention of GitGuardian and GhostAction's Oct 9 block is not used in the article. Hosts wiz.io, thehackernews.com, docs.github.com, github.blog each present by exact hostname on config/source_allowlist.txt (the site-wide wiz.io entry covers www.wiz.io). Body URLs and article.sources match exactly; the only other link is the internal Herald link.
Factual Accuracy: No discrepancies found. Numbers, dates, indicators and attributions all trace to Wiz (primary) or THN. The article correctly keeps AWS-credential provenance and exposure count as unknowns and does not claim attribution of the operator. Gheist/GhostAction: the article states only Wiz's position that they are distinct; it does not suggest they are the same or related. The internal link /article/2026-10/10-stepsecurity-says-ghostaction-pushed-credential-stealing-workflows-to-345-repositories-via-two-hijacked-maintainer-accounts-on-october-8 resolves to an existing published article about a GhostAction wave, and 'previously reported on a GhostAction wave' describes it accurately. Minor note: The Wiz quote and THN wording are single-vendor claims; the article labels them as Wiz's accordingly. Not independently verified by the Herald, and the article does not claim otherwise.
Overall Assessment: Accurate, well-attributed News coverage of an active campaign with correct scope caveats and clear unknowns; ready to publish as-is. Featured candidacy: 2 - active credential-theft campaign relevant to any GitHub Actions user, with notable gap between public-repo protection and private/Enterprise repos