Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories
Cybersecurity researchers have uncovered a large-scale supply chain attack campaign, GhostAction, that has compromised open-source maintainer accounts to inject malicious GitHub Actions workflows into thousands of repositories. These workflows exfiltrate sensitive credentials, including API keys and
Overview of the GhostAction Campaign
Cybersecurity researchers have disclosed details of an ongoing credential-theft campaign that has compromised two high-profile open-source maintainer accounts to push a malicious workflow into over 340 repositories. The campaign, attributed to GhostAction, has been active since at least September 2025 and has impacted a significant number of repositories across multiple platforms.
Attack Methodology and Workflow Injection
The attack chain begins with the acquisition of a maintainer's GitHub credentials, likely through leaked personal access tokens (PATs) or credential dumps. Once access is obtained, the attacker injects a malicious workflow named 'Security Audit' or 'GitHub Actions Security' into the default branch of the repository. These workflows are designed to exfiltrate sensitive data to a hard-coded IP address over plain HTTP.
The malicious workflow triggers on workflow_dispatch and unfiltered push events, allowing it to scan the working tree and entire git history for 13 predefined credential patterns. These patterns include AWS keys, AI service credentials, source control tokens, and SaaS and cloud API keys. The workflow also pairs AWS access key IDs with their corresponding secret access keys, further expanding the scope of data exfiltration.
Impact and Scope of the Attack
As of October 9, 2026, Socket reported that over 500 GitHub accounts have been identified as having committed the malicious workflow to tens of thousands of repositories since October 7, 2026. The campaign has impacted 817 repositories across 327 GitHub users, resulting in the exfiltration of 3,325 secrets, including PyPI, npm, and DockerHub tokens.
GitGuardian further reported that the GhostAction campaign pushed the malicious workflow to 772 public repositories belonging to 373 GitHub users and organizations between August 31 and September 30, 2026. These workflows targeted 2,577 secrets, including SSH private keys, Azure credentials, DockerHub and GHCR container registry credentials, and keys associated with Cloudflare, npm, PyPI, and AI providers.
Recommendations for Mitigation
Developers are advised to check their repositories for the presence of either of the two GitHub workflows since August 31, 2026, and assume compromise if present. Immediate actions include revoking the compromised GitHub credential, rotating credentials, and deleting the malicious workflow from all branches. It is also recommended to check forks of the infected repositories, as they may inherit the malicious workflow and pose a continued risk.
Private forks and downstream mirrors are particularly vulnerable, as private repositories are where committed credentials are typically found. Additionally, every run of the malicious workflow returns a repository identifier, allowing the attacker to map reachable execution contexts independent of any credential theft.
Conclusion
The GhostAction campaign highlights the critical importance of securing open-source repositories and maintaining strict access controls. The injection of malicious workflows into widely used repositories underscores the need for continuous monitoring and proactive security measures to prevent credential theft and data exfiltration.
Source: The Hacker News. Analysis based on publicly available information; no hands-on testing is claimed.
