GhostAction Adds Git-History Credential Harvesting to Malicious GitHub Workflows
Summary
Step Security reports that an Oct. 8 GhostAction wave injected malicious GitHub Actions workflows into 345 repositories, harvesting configured secrets and credentials from working trees and full Git histories. A run log confirmed exfiltration from uber/athenadriver.
Key points
- Step Security reports that attackers used two compromised maintainer accounts to inject malicious workflows into 345 repositories on Oct. 8: 27 repositories in one sweep and 318, including forks, in another.
- Disguised as security audits, the workflows targeted configured GitHub Actions secrets and credentials found in working trees and Git history, including credentials deleted from the current tree.
- The newer workflow used a full-depth checkout and git log -p --all to inspect repository history; it also captured context around AWS key IDs to help pair them with secret keys.
- The payload sent collected data over plain HTTP to 193.32.204.199. Step Security says an Uber athenadriver run log showed the server acknowledging receipt four seconds after the workflow started.
- The article reports 378 repositories with a live malicious workflow on the default branch as of Oct. 9; 182 contained a history-mining marker and 88 showed a marker indicating named secrets were templated.
- Step Security recommends rotating credentials ever committed to affected repositories, revoking the compromised GitHub credential, removing malicious workflows from all branches, and restricting runner egress. A workflow-run approval gate reportedly stopped exfiltration in one observed case.
Article Details
- Attack Vectors
- The attackers used compromised maintainer accounts to push malicious workflows directly to repositories’ default branches, bypassing pull requests and review.
- The workflows triggered on pushes or manual dispatch, collected configured GitHub Actions secrets, and searched working trees and full Git histories for credentials.
- The payload sent collected data to attacker-controlled infrastructure using HTTP POST requests to a hardcoded IP address.
- The article says the maintainer credentials were most plausibly leaked personal access tokens from infostealer logs or credential dumps; this is presented as an assessment, not a confirmed acquisition method.
- Defensive Notes
- Treat any appearance or completed run of the named malicious workflows as a breach; remove them from all branches and review workflow runs and audit logs.
- Revoke the compromised GitHub credential and rotate all Actions secrets and credentials ever committed to any branch, including credentials deleted from current files.
- Require approval for workflow runs where feasible, and protect workflow files with branch rules requiring pull-request review.
- Restrict runner egress with an enforced allowed-endpoints policy; review network telemetry for connections to the listed C2 infrastructure.
- Check forks and avoid publishing releases until repositories and credentials have been cleaned up.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | bold-dhawan[.]45-139-104-115[.]plesk[.]page | Domain listed as a legacy GhostAction exfiltration endpoint. |
| DOMAIN | carte-avantage[.]com | Domain listed as a legacy GhostAction exfiltration endpoint. |
| IPV4 | 170[.]39[.]218[.]2 | Additional legacy GhostAction endpoint identified by the article for historical log review. |
| IPV4 | 193[.]32[.]204[.]199 | Current campaign exfiltration endpoint; the article reports successful data delivery and acknowledgment from this IP. |
| IPV4 | 45[.]139[.]104[.]115 | Legacy GhostAction exfiltration infrastructure identified by the article for historical log review. |
| URL | hxxp[:]//193[.]32[.]204[.]199 | Attacker endpoint used by the classic workflow variant to POST repository secrets. |
| URL | hxxp[:]//193[.]32[.]204[.]199/?c=monami | Attacker exfiltration URL used when the workflow had templated named repository secrets. |
| URL | hxxp[:]//193[.]32[.]204[.]199/?c=new | Attacker exfiltration URL used by the history-sweep payload; the article reports a successful request to this endpoint. |
MITRE ATT&CK
T1020 · Automated ExfiltrationThe attackers used automated workflows to collect and transmit credentials across hundreds of repositories.T1041 · Exfiltration Over C2 ChannelThe workflow exfiltrated collected credentials to attacker infrastructure through HTTP POST requests.T1059.004 · Unix ShellThe injected GitHub Actions workflow ran shell commands to search for credentials, inspect Git history, and send collected data.T1071.001 · Web ProtocolsThe workflow communicated with the exfiltration endpoint over plain HTTP.T1078 · Valid AccountsThe attackers used compromised maintainers’ legitimate GitHub identities to push workflows into repositories.T1195.002 · Compromise Software Supply ChainThe campaign injected malicious workflows into open-source repositories, including a repository whose tainted release could propagate to downstream users.T1552.001 · Credentials In FilesThe payload searched repository files and full Git history for exposed credentials and secrets.
People
Henry WuThe original athenadriver author whose compromised account was used to push the malicious workflow across repositories and forks; the article reports the account was compromised.Takashi KitaoThe pyxel maintainer whose compromised account was used to push the malicious workflow to repositories; the article reports the account was compromised.
Vendors
Products
GitHub ActionsOn October 8, 2026, attackers operating the GhostAction GitHub Actions credential-theft campaign compromised two high-profile open-source maintainer accounts and swept 345 repositories in two automated windows lastingHarden-RunnerHarden-Runner provides network and process visibility during CI/CD runs and correlates outbound connections with the responsible repository, workflow, and step. The C2 address in this campaign, 193.32.204.199, has beenpyxelwindows lasting minutes. Using the account of Takashi Kitao, author of the 18,400-star game engine pyxel, the attacker pushed a malicious workflow to 27 repositories starting at 13:20 UTC. Eight hours later, the