GhostAction Campaign Plants Credential-Stealing GitHub Workflows in Thousands of Repositories

Summary

Researchers report that GhostAction actors used compromised maintainer accounts to plant malicious GitHub Actions workflows, stealing repository secrets and credentials. Developers are urged to check repositories, remove the workflows, and rotate exposed credentials.

Key points

• Two compromised maintainer accounts pushed a malicious workflow to 345 repositories; Socket identified more than 500 accounts that committed it to tens of thousands of repositories since October 7, 2026.
• The workflows, named Security Audit or GitHub Actions Security, exfiltrate secrets to a hard-coded IP address over plain HTTP.
• Stolen data may include GitHub Actions secrets, credentials in working trees and Git history, cloud and AI-provider keys, and package-registry tokens.
• Earlier GhostAction activity was reported across hundreds of repositories and GitHub users, with thousands of secrets exfiltrated.
• At least one affected repository was modified to include an XMRig cryptocurrency miner; no malicious package releases using compromised publishing credentials were reported.
• Developers should search repositories for the workflows, revoke and rotate compromised credentials, remove the files from all branches, and check forks and downstream mirrors.

Indicators of compromise

People

Threat Actors

Malware

Products

Industries

Related Articles

• Malicious Go Module Reveals 222-Repository GitHub Malware Lure NetworkXMRig · GitHub Actions
• Attackers Exploit AhsayCBS Flaws to Install XMRig Miners Disguised as Microsoft EdgeXMRig
• Unpatched AhsayCBS Flaws Exploited to Deploy Webshells and CryptominersXMRig
• Unpatched AhsayCBS Flaws Exploited to Install Webshells and Cryptocurrency MinersXMRig
• PoeLLM Malware Targets Exposed AI and LLM Servers to Expand Crypto-Mining BotnetXMRig