GhostAction Targets 30,000+ Repositories After Compromising About 1,900 GitHub Accounts
Summary
GitGuardian reports that a GhostAction wave targeted over 30,000 repositories, using compromised GitHub accounts to deploy workflows that scan for secrets. GitHub began blocking the workflow on October 9, 2026.
Key points
- GitGuardian observed a spike on October 8–9, 2026, involving about 1,900 compromised GitHub accounts and attempted extraction of 3,174 secrets from public repositories’ CI.
- Attackers reportedly used stolen Personal Access Tokens or credentials from infostealer logs and dumps to gain repository write access.
- Malicious GitHub Actions workflows were disguised with names such as Security Audit and GitHub Actions Security.
- The evolving payload scanned Git history for secrets, including cloud keys, developer-platform tokens, and AI provider API keys; later variants collected nearby context to help pair AWS key IDs with secret access keys.
- GitGuardian said the workflow was deployed first to 160 previously observed victims, then to 28,000 new repositories. Further waves on October 10 and 12 could not extract secrets after GitHub began preventing the workflow from running.
- Some victims had also been compromised in earlier waves, which GitGuardian said may allow attackers to exploit secrets that were not rotated.
Article Details
- Attack Vectors
- Compromised legitimate developer accounts using stolen Personal Access Tokens (PATs) or credentials harvested from infostealer logs and dumps to gain repository write access.
- Attackers injected deceptive GitHub Actions workflows into repositories, using filenames such as "security-audit.yml" and "github_actions_security.yml".
- Malicious workflows scanned Git history for secrets and attempted to extract CI/CD secrets, cloud credentials, package registry tokens, and AI provider API keys. A later payload variant captured nearby context around AWS key IDs to identify matching secret access keys.
- Defensive Notes
- Rotate exposed secrets, including credentials that may have remained unrotated after earlier compromises.
- GitHub started preventing the malicious workflow from running beginning October 9, 2026; the article reports that later waves on October 10 and 12 could not extract secrets.
People
Vendors
Products
GitHub"This resulted from compromising the GitHub accounts of about 1,900 users. It attempted to extract 3,174 secrets from public repositories' CI," security researchers Gaetan Ferry and Guillaume Valadon said.GitHub Actions2025, it involves threat actors compromising legitimate developer accounts to inject malicious GitHub Actions automation workflows into software repositories.