GhostAction Campaign Targets 346 Repositories to Steal CI/CD and Cloud Credentials
Summary
Socket found a GhostAction wave that injected malicious GitHub Actions workflows into 346 repositories, stealing Actions secrets and scanning current files and Git history for cloud and other credentials.
Key points
- Two compromised maintainer accounts added a workflow named security-audit.yml to repositories they could write to, including an Uber-owned repository.
- The workflow runs on pushes and can also be started manually; it sends collected data to 193.32.204[.]199.
- It targets GitHub Actions secrets and scans working files and full repository history for 13 credential patterns, including AWS, AI service, source-control, and SaaS tokens.
- Socket later identified more than 500 GitHub accounts that committed the workflow to tens of thousands of repositories; some were organization-owned.
- The workflow ran successfully in affected repositories. Socket reported no malicious package releases on PyPI or crates.io as of publication.
- Recommended response includes removing the workflow, revoking and rotating exposed credentials, reviewing workflow runs and audit logs, and checking package releases and AWS activity.
Article Details
- Attack Vectors
- Compromised maintainer credentials were used to commit a malicious workflow directly to repositories’ default branches.
- The workflow ran on pushes to any branch or tag and could also be triggered manually; it collected GitHub Actions secrets and credentials found in working-tree files and repository history.
- Collected data was sent in an HTTP POST to the hardcoded IP address 193.32.204[.]199.
- Defensive Notes
- Remove the malicious workflow and revert its commit from every affected repository, including organization-owned repositories and forks.
- Treat completed workflow runs as successful exfiltration; rotate exposed credentials and revoke exposed personal access tokens.
- Review full repository history, including branches, tags, and unreachable objects, for committed credentials; review AWS CloudTrail and IAM changes where AWS credentials may have been exposed.
- Revoke account sessions, personal access tokens, OAuth grants, and SSH keys; enforce phishing-resistant MFA and review organization audit logs for unauthorized workflow additions.
- Hunt for connections to 193.32.204[.]199 and block the address; enable GitHub secret scanning with push protection and require approval for workflow runs from outside collaborators.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 193[.]32[.]204[.]199 | Identified by the article as the C2 IP address receiving stolen credentials. |
| URL | hxxp[:]//193[.]32[.]204[.]199 | Hardcoded destination used by the malicious workflow to POST collected credentials. |
| URL | hxxp[:]//193[.]32[.]204[.]199/?c=monami | Specific hardcoded POST destination shown in the workflow for exfiltrating collected data. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelCollected credentials are exfiltrated in the POST request to the campaign’s C2 IP address.T1059.004 · Unix ShellThe GitHub Actions workflow executes shell commands to search files and Git history for credentials.T1071.001 · Web ProtocolsThe workflow sends collected data to the hardcoded IP address using an HTTP POST.T1078 · Valid AccountsCompromised maintainer accounts were used to commit the malicious workflow to repositories.T1119 · Automated CollectionThe workflow automatically collects repository secrets and credential-pattern matches across files and history.T1552.001 · Credentials In FilesThe workflow searches repository files and commit history for hardcoded credentials.
Vendors
Products
crates.ioin affected repositories. Socket has observed no malicious package versions published to PyPI or crates.io as a result of this activity at the time of writing.GitHub Actionsinto 346 repositories — among them uber/athenadriver and the 18,420-star kitao/pyxel — merging GitHub Actions secret theft with a new sweep of the working tree and full git history for cloud credentials, postedPyPIrun successfully in affected repositories. Socket has observed no malicious package versions published to PyPI or crates.io as a result of this activity at the time of writing.