GhostAction Campaign Plants Secret-Stealing GitHub Actions Workflows in Tens of Thousands of Repositories

A credential-stealing campaign known as GhostAction has planted malicious GitHub Actions workflows in tens of thousands of repositories, according to research from Socket, StepSecurity and GitGuardian reported by The Hacker News on October 9. The workflows are disguised as security audits but are built to steal passwords, API keys and other secrets.

How the attack works

GitHub Actions is GitHub’s built-in automation system. Developers add small configuration files called workflows to a repository, and GitHub runs them automatically, for example to test or publish code. Workflows often need access to “secrets” such as cloud credentials or publishing tokens, which GitHub stores and hands to the workflow when it runs. That makes a malicious workflow a direct route to those secrets.

According to the researchers, the attack follows four steps:

1. The attacker obtains a maintainer’s GitHub credentials, most likely a leaked personal access token from infostealer malware logs or credential dumps.
2. Existing workflow files are scanned to learn which secrets the repository uses.
3. A new workflow named security-audit.yml or github_actions_security.yml is pushed to the default branch under the victim’s own identity.
4. The workflow runs a single “Audit” step that collects secrets and sends them over plain HTTP to a hard-coded IP address, 193.32.204[.]199.

What it steals

The workflow grabs the repository’s named GitHub Actions secrets and searches both the current files and the full git history for credentials matching 13 patterns. These cover AWS keys, AI service keys such as Anthropic, OpenAI and OpenRouter, GitHub and GitLab tokens, and other SaaS and cloud API keys. GitGuardian’s broader analysis lists 2,577 targeted secret types, including SSH keys, Azure, Docker Hub and Google Cloud credentials, database passwords, and npm and PyPI publishing tokens.

Scale of the campaign

• Socket reports that since October 7, 2026, more than 500 GitHub accounts have committed the malicious workflow to tens of thousands of repositories.
• StepSecurity reported the compromise of two maintainer accounts that pushed the workflow to more than 340 repositories, including projects in the pyxel namespace.
• GitGuardian found 772 public repositories belonging to 373 users and organizations affected between August 31 and September 30, 2026.

GhostAction was first reported in September 2025, when it hit 817 repositories across 327 GitHub users and exfiltrated 3,325 secrets. In a related incident on August 30, 2026, attackers modified the kuafuai/DevOpsGPT repository to embed an XMRig cryptocurrency miner in its Docker image. As of the reporting, no malicious package releases had been published using stolen publishing credentials.

What developers should do

• Check repositories for either workflow file dating from August 31, 2026 or later. If one is present, assume the repository’s secrets are compromised.
• Revoke the compromised GitHub credential and rotate every secret the repository could access.
• Delete the malicious workflow from all branches, not just the default one.
• Check forks. Socket reports that 279 forks in one affected namespace carry the workflow, and private forks and mirrors are the most exposed because they often contain committed credentials.

Stolen developer credentials remain one of the most reliable ways into the software supply chain. We previously covered the Shai-Hulud infostealer scanning 469 locations for developer credentials and a study that found over 9,300 exposed AWS keys still active.

Sources

• The Hacker News: Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories (October 9, 2026)