GhostAction returns: about 1,900 hijacked GitHub accounts pushed secret-stealing workflows to 30,000 repos
GitGuardian counts more than 30,000 repositories and about 1,900 compromised GitHub accounts in GhostAction's October wave, which committed workflows that dump Actions secrets and scan git history for credentials. Some victims were hit in 2025 and never rotated.
The GhostAction campaign, first reported in September 2025, came back in two waves this year. From August 31, GitGuardian saw a malicious workflow pushed to 772 public repositories belonging to 373 users and organizations. Then on October 8 and 9 activity spiked: GitGuardian now counts more than 30,000 repositories across roughly 3,000 owners, about 1,900 compromised accounts, and 3,174 targeted secrets. Commits were made under the victims' own identities with what GitGuardian calls apparently stolen credentials. The workflow, named security-audit.yml or github_actions_security.yml, runs on any push, dumps the repository's Actions secrets, scans the working tree and full git history for credential patterns including AWS, GitHub, GitLab and AI provider keys, and posts them over plain HTTP to a bare IP. GitHub began blocking the workflow from running on October 9, so later waves on October 10 and 12 extracted nothing.
Why it matters
Two identity failures stack here. The entry point is a stolen GitHub credential that can write workflow files, and the prize is every secret those workflows can read. GitGuardian found October victims who were also hit in September 2025 and August 2026, and 92 cases where the attacker simply edited a workflow left behind by an earlier wave. Secrets that were exposed and never rotated are the campaign's renewable resource.
If either filename appears in any branch since August 31, assume every repository secret and anything in git history is exposed. Revoke the GitHub token or PAT that made the commit (otherwise someone else will reuse it), rotate the secrets, remove the workflow from all branches, and check forks, which inherit it. Longer term, replace stored cloud keys with workload identity federation so there is nothing static to dump. See secrets in repositories and CI. The Hacker News covered the first October sweeps on October 9; GitGuardian published its analysis of the return.
Source: The Hacker News
Related on Start with Identity
- BlogGheist turns stolen GitHub tokens into secret dumps through Actions logs
Wiz reported on October 25 that the Gheist campaign used stolen GitHub tokens from infostealer logs and past supply-chain leaks to plant more than 13,500 ci-syn
- BlogLiteLLM traces its poisoned release to an admin key leaked in May and never revoked
LiteLLM's October 23 attack-chain report says an Agent Platform admin key committed to a public repo on May 27 was deleted but never revoked. On October 10 it r
- BlogGhostAction phish completes a GitHub device flow, then hides a stealer in a font file
OpenSourceMalware found a fake GitHub security alert that proxied a maintainer's password and 2FA code, then silently completed an OAuth device flow for repo, w
- CVETrivy release and GitHub Action tags hijacked to steal CI secrets
With credentials left valid by a non-atomic rotation, an attacker shipped a malicious Trivy v0.69.4 and repointed 76 of 77 trivy-action tags to code that dumped
- CVEtj-actions/changed-files tags repointed to dump CI secrets into logs
An attacker repointed tj-actions/changed-files version tags to a commit that read the GitHub Actions runner's memory and printed its secrets into workflow logs.
- CVEOver-scoped CodeBuild GitHub token let an attacker ship code in Amazon Q Developer 1.84.0
An inappropriately scoped GitHub token in the CodeBuild configuration for the Amazon Q Developer VS Code extension let an attacker commit code that shipped auto