GhostAction Workflows Were Blocked, but Nearly 1,800 Accounts Remain Compromised
Summary
GitGuardian reported 72,000 GhostAction commits across 23,000 public repositories. GitHub prevented workflow execution, but 1,792 accounts remained compromised; the researchers found no evidence the PolinRider-style local stealer ran.
Key points
- GitGuardian reported that GhostAction's operator pushed 72,000 commits to 23,000 public repositories from Oct. 13–21; 8,000 repositories were new targets.
- The malicious workflows sought credentials from repositories, Git history, runner environments, and wikis, including AI-provider keys and tokens.
- One payload targeted GitHub OIDC tokens to assume AWS roles; another disguised a Node.js credential stealer as a VS Code task.
- The local stealer imitated PolinRider, but GitGuardian found no evidence it ran or established overlap between the campaigns.
- GitHub identified the malicious workflows and prevented their execution, according to GitGuardian.
- GitGuardian reported 1,792 compromised accounts remained accessible; 1,382 had also been used in activity on Oct. 8.
- Repository owners should remove listed malicious files across branches, revoke compromised account tokens, and rotate exposed credentials and Actions secrets.
Article Details
- Event Type
- Supply-chain campaign targeting GitHub repositories through compromised developer accounts and malicious GitHub Actions workflows.
- Impact
- GitHub identified and prevented execution of the malicious workflows. GitGuardian reported 1,792 compromised accounts, including 1,382 previously used in the Oct. 8 activity, and reported 72,000 commits pushed to 23,000 public repositories between Oct. 13 and 21. GitGuardian said it had no evidence that the PolinRider-styled local stealer ran. The payloads sought credentials and included an attempt to obtain AWS OIDC tokens to assume cloud roles.
MITRE ATT&CK
T1195.002 · Compromise Software Supply ChainThe campaign inserted malicious GitHub Actions workflow files into repositories to exploit CI/CD workflows; GitHub reportedly prevented their execution.T1552.001 · Credentials In FilesThe malicious workflows searched repositories, Git history, runner repositories, and wikis for credentials, including API keys and tokens.
People
Vendors
Amazon Web Servicesself-hosted runner payloads targeting self-hosted CI runners; a payload targeting GitHub runners and AWS-requesting GitHub OIDC tokens (in order to assume AWS roles and achieve cloud account access); and the fontGitHubGhostAction, an ongoing campaign in which attackers target GitHub by compromising developer accounts and injecting GitHub Actions workflow files into repositories.
Products
AWSself-hosted runner payloads targeting self-hosted CI runners; a payload targeting GitHub runners and AWS-requesting GitHub OIDC tokens (in order to assume AWS roles and achieve cloud account access); and the fontGitHub ActionsGhostAction, an ongoing campaign in which attackers target GitHub by compromising developer accounts and injecting GitHub Actions workflow files into repositories.VS CodeThe font stealer family installs a Node.js credential stealer on local developer machines, disguised as a VS Code task. The technique appears to be copied from PolinRider, a campaign that hides obfuscated loaders in