GhostAction Campaign Expands GitHub Actions Credential Theft and Targets Developer Repositories

Oct 9, 2026 · Original article ↗

Summary

GhostAction attackers injected GitHub Actions workflows to steal secrets and scan repository history. A new wave affected 346 repositories; researchers validated 790 repositories overall. my-github[.]com is linked to the collector IP, but operator attribution remains un

Key points

Attackers used compromised maintainer accounts to inject workflows into writable repositories, triggering them on pushes or through manual execution.
The workflows stole named Actions secrets; a newer variant also searched checked-out files and full Git history for credentials, then sent results over HTTP to 193.32.204[.]199.
Socket and StepSecurity reported an October 8 sweep affecting 346 repositories across two compromised accounts. Researchers validated 790 affected repositories through October 9.
The article links my-github[.]com to the collector IP, but says direct control by the GhostAction operator is unproven. my-gitlab[.]com is a lower-confidence watchlist domain, not confirmed campaign infrastructure.
Successful workflow executions were observed, but the article reports no malicious PyPI or crates.io releases attributed to the October wave at publication time.
Removing workflows does not revoke stolen credentials. Recommended response includes revoking access tokens and grants, rotating exposed secrets, auditing releases and deployments, and rebuilding trusted artifacts.

Article Details

Attack Vectors: Attackers use access associated with compromised GitHub identities to enumerate writable repositories and inject workflows under .github/workflows/; pushes or workflow_dispatch can trigger execution.
The workflows collect named GitHub Actions secrets, scan checked-out files and reachable Git history for credentials, and send the results to external infrastructure over HTTP.
The article reports a separate DevOpsGPT Miner activity that modifies repository files to install and persist XMRig.
Defensive Notes: Temporarily disable Actions where needed and preserve workflows, run IDs, logs, commits, audit logs, and package and release records.
Revoke compromised GitHub tokens, OAuth grants, app credentials, deploy keys, and sessions; remove malicious workflows and rotate all exposed secrets, including credentials found in repository history.
Audit packages, releases, images, and deployments produced during the compromise window, and rebuild trusted artifacts from a verified pre-compromise commit in a clean environment.
Monitor the named infrastructure and domains across DNS, proxy, browser, email, endpoint, Git, package, workflow, and shell-history telemetry; investigate connections from runners and developer systems.
Require review or approval for workflow changes, enforce least privilege and protected branches, and use runner egress allowlists. The article reports workflow approval as a control that stopped exfiltration in this wave.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`bold-dhawan[.]45-139-104-115[.]plesk[.]page`	Historical domain endpoint reported for the September 2025 GhostAction wave.
DOMAIN	`carte-avantage[.]com`	Reported GhostAction exfiltration endpoint; the domain was also reported as a phishing site.
DOMAIN	`my-github[.]com`	Suspicious GitHub-themed domain resolving directly to the current GhostAction collector; operator attribution is unresolved.
DOMAIN	`objective-hopper[.]45-139-104-115[.]plesk[.]page`	Historical domain endpoint reported for the September 2025 GhostAction wave.
DOMAIN	`pool[.]supportxmr[.]com`	Mining-pool hostname configured in the separate DevOpsGPT Miner activity using XMRig.
HOSTNAME	`api[.]my-github[.]com`	Reported GitHub-themed hostname resolving to the GhostAction collector; individual active use is unconfirmed.
HOSTNAME	`gh[.]my-github[.]com`	Reported GitHub-themed hostname resolving to the GhostAction collector; individual active use is unconfirmed.
HOSTNAME	`ghassets[.]my-github[.]com`	Reported GitHub-themed hostname resolving to the GhostAction collector; individual active use is unconfirmed.
HOSTNAME	`github[.]my-github[.]com`	Reported GitHub-themed hostname resolving to the GhostAction collector; individual active use is unconfirmed.
HOSTNAME	`sncf[.]carte-avantage[.]com`	Reported phishing hostname impersonating SNCF Connect and collecting identity and payment-card data.
IPV4	`170[.]39[.]218[.]2`	Historical GhostAction infrastructure reported during October–December 2025 and March 2026.
IPV4	`193[.]32[.]204[.]199`	Current GhostAction collection and scanning host; workflows POST stolen secrets and repository data to it.
IPV4	`45[.]139[.]104[.]115`	Legacy GhostAction infrastructure used in the campaign's first version.
SHA256	`7fbd40446a82c77b23432c6ab73bd8595c98e90e4f4a473198b4d1256f3e8c4b`	SHA-256 of the claudecord PyPI package version 0.3.2, which contained a workflow that POSTed deployment and publishing secrets.
URL	`hxxp[:]//193[.]32[.]204[.]199:3000/api/workflow/receive?inj=<id>`	Reported GhostAction collection route verified in a workflow variant.
URL	`hxxp[:]//193[.]32[.]204[.]199/?c=monami`	HTTP exfiltration endpoint used by the newer security-audit workflow.