GhostAction Exploits 1,900 GitHub Accounts, Hits 30,000 Repositories

About 1,900 GitHub accounts were compromised and attackers pushed a malicious workflow to more than 30,000 repositories across roughly 3,000 users and organizations during a concentrated surge observed on October 8 and 9, 2026.

GhostAction: scope and immediate impact

The credential‑theft campaign known as GhostAction targeted developer infrastructure on GitHub by compromising legitimate maintainer accounts and injecting malicious GitHub Actions automation workflows into repositories. Security researchers Gaetan Ferry and Guillaume Valadon reported that the October 8–9 spike "resulted from compromising the GitHub accounts of about 1,900 users. It attempted to extract 3,174 secrets from public repositories' CI."

GitGuardian’s analysis places the scale of the burst plainly: the activity touched more than 30,000 repositories and about 3,000 distinct users and organizations. The operation aimed at high‑value artifacts stored in CI/CD environments—cloud credentials, package registry tokens and AI provider API keys among them.

Techniques: stolen PATs, infostealer dumps, and deceptive filenames

Attackers gained write access to repositories by using stolen Personal Access Tokens (PATs) or credentials harvested from infostealer logs and dumps. With hijacked maintainer privileges they pushed malicious workflow files into projects under deceptive names such as "security-audit.yml" and "github_actions_security.yml".

Once present in a repository, these workflows attempted large‑scale extraction of CI/CD secrets, including cloud provider API keys, package registry tokens for npm, PyPI and DockerHub, and AI provider API credentials.

Payload evolution: history scanning and secret‑context capture

GitGuardian says this wave of GhostAction — first observed since August 31, 2026 — showed a more experimental and manual pattern, with the payload evolving in stages. "This new wave seems more experimental and manual than previous ones, with the payload evolving over time," GitGuardian observed.

Earlier reporting from Socket and StepSecurity described the history‑scanning feature that was incorporated into the new payload: secret‑detection regular expressions covering AWS key IDs, GitHub and GitLab tokens, AI‑related secrets, and other cloud API keys. The campaign’s second payload version added the ability to capture about two lines of surrounding context for each AWS key ID hit so the attackers could pair IDs with their secret access keys. A third variant extended that capability to retrieve secret context during the git history scan.

Deployment pattern and defensive intervention

GitGuardian describes the October surge as a phased deployment. "This payload was deployed in multiple phases," the company said: first to 160 previously observed victims, then—20 minutes later—to 28,000 additional repositories between October 8 and 9. New waves using the same payload were observed on October 10 and October 12.

However, GitHub began preventing the malicious workflow from running starting October 9; as a result, the waves observed on October 10 and 12 "could not extract any secrets." The October surge also included a subset of victims that had been previously compromised in the September 2025 and August 2026 waves, a pattern GitGuardian flagged as evidence the threat actors were banking on unrotated secrets.

What this means for open‑source maintainers, enterprise security teams, and threat actors

• Open‑source maintainers and developer teams: monitor repositories for unexpected workflow files and review commit and workflow histories for entries named like "security-audit.yml" or "github_actions_security.yml"; be aware that history scanning can reveal older, unrotated secrets.
• Enterprise security and CI/CD teams: the campaign illustrates the value of rotating secrets and guarding PATs and other credentials that grant repository write access—GitGuardian’s findings show attackers reused prior compromises and were able to attempt extraction of thousands of CI secrets.
• Threat actors and intrusion responders: the phased and evolving payload—moving from simple scanning to capturing secret context in git history—demonstrates how malicious GitHub Actions can be adapted rapidly; defenders should prioritize controls that prevent workflows from executing if pushed by compromised accounts.

GhostAction is neither a new technique nor a static one: first discovered in September 2025, it has reappeared with iterative payload enhancements and a willingness to reuse previously compromised accounts and repositories. The October 8–9 spike underlines two practical truths contained in the available facts: attackers will continue to target developer tooling where high‑value secrets live, and interventions that block malicious workflows from running can materially limit what an attacker can steal.

Original reporting: https://thehackernews.com/2026/10/ghostaction-compromises-about-1900.html