GhostAction Attack Hits Tens of Thousands of GitHub Repositories to Steal Cloud and AI Credentials

A new wave of the GhostAction supply chain campaign has pushed a credential-stealing GitHub Actions workflow into tens of thousands of repositories.

It now hunts for cloud and AI keys buried in source code and git history, in addition to CI/CD secrets.

Socket says it has identified more than 500 GitHub accounts that committed the malicious workflow since October 7, 2026, including several organization-owned repositories reached through compromised contributors.

These included uber/athenadriver and the 18,420-star kitao/pyxel. Commit messages read “Add security audit workflow” or “Update security audit workflow.”

Despite the name, the file has no security function and posts stolen data to hxxp://193.32.204[.]199.

The operator first obtains a maintainer credential, and Socket did not observe how. The operator then extracts the Actions secret names each repository already uses and hardcodes them into the payload.

Finally, the operator commits the file straight to the default branch, where it runs on the next push. The workflow triggers on any push to any branch or tag, plus manual dispatch.

GitGuardian first documented GhostAction in September 2025. That campaign hit 817 repositories across 327 users and exfiltrated 3,325 secrets. Earlier waves stole only values stored as Actions secrets.

This variant adds fetch-depth: 0, which pulls every branch and tag, then runs git log -p –all so the payload can read the full patch history. That exposes credentials developers believed they had delete.

Socket analyzed that, burst in which two compromised maintainer accounts, henrywoo and kitao, committed a workflow named security-audit.yml to 346 repositories.

GhostAction Supply Chain

The payload matches 13 regex patterns covering AWS keys, Anthropic, OpenAI and OpenRouter keys, GitHub and GitLab tokens, Google API keys, Slack tokens and SendGrid keys.

It also captures two lines on either side of every AKIA or ASIA key ID. The 40-character secret key usually sits nearby, so this reassembles usable AWS key pairs instead of orphaned identifiers.

GitGuardian’s later tally puts the campaign at more than 30,000 repositories across 3,000 users and organizations.

It attributes this to about 1,900 compromised accounts and 3,174 secrets targeted in public repositories’ CI. One burst hit roughly 28,000 new repositories between October 8 and 9.

Socket calls kitao/pyxel the highest-value target. The repository ships through PyPI and crates.io, and the payload named its CARGO_REGISTRY_TOKEN, PYPI_PASSWORD, PYPI_USERNAME and PERSONAL_ACCESS_TOKEN secrets.

Socket had seen no malicious package releases at the time of writing. The henrywoo namespace also carried 279 forks, plus machine learning projects such as pyllama and chatllama. Their audiences often hold AWS and AI API keys.

Unlike the September 2026 wave, where GitHub held most runs for approval, these runs executed and exfiltrated data. GitHub began blocking the workflow from running on October 9.

Later waves on October 10 and 12 therefore could not extract secrets. GitGuardian also found that the actor relies partly on unrotated secrets stolen in earlier campaigns.

Defenders should read the secret list in the injected file. A populated list means Actions secrets were exposed, and an empty one means only the repository sweep applies.

Rotate every named secret, and revoke rather than rotate exposed personal access tokens. Scan full history for the 13 credential classes and rotate anything found.

Review CloudTrail for AWS keys. Then remove the workflow, treat the account as compromised, enforce phishing-resistant MFA and block 193.32.204[.]199.

GitGuardian stresses that you must also revoke the GitHub credential used for injection, because stolen tokens are often reused by other actors, including cryptominer operators.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.