A new GhostAction campaign has expanded to more than 500 compromised GitHub accounts and has injected malicious workflows into tens of thousands of repositories since October 7, 2026.
Socket’s October 9 update describes a credential theft operation targeting GitHub Actions secrets, cloud credentials, and AI service API keys embedded in source code and repository history.
An initially analyzed October 8 burst affected 346 repositories through compromised maintainer accounts henrywoo and kitao.
GhostAction Hackers Compromise 500+ GitHub Accounts
Targets included uber/athenadriver and kitao/pyxel, exposing how contributor permissions can extend an account compromise into organization-owned projects. Socket did not determine how attackers obtained the initial maintainer credentials.
Attackers committed .github/workflows/security-audit.yml directly to repository default branches using messages such as “Add security audit workflow.”
Despite its reassuring name, the workflow harvests credentials. It runs on push events without branch or path restrictions and supports manual execution through workflow_dispatch.
Before deployment, attackers apparently inspected existing workflows to identify referenced Action secrets, then inserted those names into a reusable payload.
In Pyxel, the workflow targeted CARGO_REGISTRY_TOKEN, PERSONAL_ACCESS_TOKEN, PYPI_PASSWORD, and PYPI_USERNAME, creating potential exposure across GitHub, PyPI, and crates.io. The uniform payloads and compressed deployment windows suggest automated enumeration and injection.
The new variant adds a repository scanning stage alongside the established Actions secret theft mechanism.
Using actions/checkout@v4 with fetch-depth: 0, it retrieves history across branches and tags, then examines working-tree files and patch output from git log -p --all. Its history buffer is capped at 200,000 lines.
Thirteen credential patterns cover AWS access identifiers, secret keys and session tokens; Anthropic, OpenAI and OpenRouter API keys; GitHub and GitLab tokens; and Google, Slack and SendGrid credentials.
Historical scanning can uncover secrets removed from current files but still retained in reachable commits. The payload also captures two surrounding lines on either side of AWS access key identifiers.
This context can expose adjacent secret access keys, helping attackers recover usable credential combinations rather than isolated identifiers. Collected data and repository identifiers are transmitted together through a cleartext HTTP POST to hxxp://193.32.204[.]199/?c=monami.
Socket confirmed successful workflow runs in affected repositories, with Pyxel providing the clearest publishing-credential targeting example. However, researchers had observed no malicious PyPI or crates.io releases attributable to this activity.
Defenders should remove injected workflows, review execution logs, revoke compromised account access, and rotate exposed credentials. Response must cover both Actions secrets and committed credentials, including historical exposures.
Socket also recommends auditing package releases, reviewing AWS CloudTrail activity, blocking the exfiltration address, enabling secret scanning with push protection, and inspecting affected forks before enabling Actions. Organization-wide checks should follow account permissions.
| Category | Indicator | Description |
|---|---|---|
| Workflow file path | .github/workflows/security-audit.yml | Malicious workflow file masquerading as a security audit. |
| Workflow file path | .github/workflows/github_actions_security.yml | Alternative malicious workflow file path. |
| Commit message | Add security audit workflow | Commit message associated with malicious workflow injection. |
| Commit message | Update security audit workflow | Commit message associated with malicious workflow updates. |
| Commit message | Add Github Actions Security workflow | Alternative commit message associated with workflow injection. |
| Request body marker | REPO= | Identifies the repository in the exfiltration request body. |
| Request body marker | AKIA_CTX_START | Marks the beginning of collected AWS credential context. |
| Request body marker | AKIA_CTX_END | Marks the end of collected AWS credential context. |
| Network — C2 IP address | 193.32.204[.]199 | Attacker-controlled destination used for credential exfiltration. |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
