A large supply chain attack is targeting GitHub Actions workflows, and researchers say credential-theft payloads have been planted in tens of thousands of repositories. Security firms StepSecurity and Socket have tied the campaign to GhostAction, the same operation that first showed up in September 2025.
How the GitHub Actions attack spread
The attackers are not breaking into GitHub itself. They are using leaked developer credentials, most likely personal access tokens taken from infostealer logs and credential dumps. With the account of Takashi Kitao, author of the popular 18,400-star game engine pyxel, the attacker pushed a malicious workflow to 27 repositories starting at 13:20 UTC. Eight hours later, the account of Henry Wu, the original author of Uber’s athenadriver, was used to push the same workflow to 318 repositories in a 16-minute window.
Socket says it has identified more than 500 GitHub accounts that committed the malicious workflow to tens of thousands of repositories since October 7, 2026. An earlier wave tracked by GitGuardian hit 772 public repositories belonging to 373 users and organizations between August 31 and September 30, targeting 2,577 secrets in total.
What the malicious workflow steals
The injected files are named to look helpful, either “Security Audit” or “GitHub Actions Security”. Once triggered, they send data to a hard-coded IP address over plain HTTP. The loot includes the repository’s named GitHub Actions secrets, cloud and CI/CD credentials, and anything sitting in the working tree or git history: AWS access keys, Anthropic, OpenAI and OpenRouter API keys, GitHub and GitLab tokens, SSH private keys, and database passwords.
The workflow runs on any push or manual dispatch, checks out the full history with fetch-depth 0, and then does four things: it appends the named secrets it found earlier, scans the working tree for 13 credential patterns, re-scans the entire git history for the same patterns to catch deleted keys, and pairs AWS access key IDs with their matching secret keys before sending everything out.
What Indian developers and teams should do
If your organisation uses GitHub Actions for deployments, treat this as a credential hygiene emergency. Check every repository for workflows named “security-audit.yml” or “github_actions_security.yml” added since August 31, 2026. If you find one, assume compromise.
The cleanup steps are direct: revoke the leaked GitHub credential, rotate every secret that lived in the repository, delete the malicious workflow from all branches, and check forks of infected repositories too. In one observed case, the attackers even edited a Docker image to embed an XMRig cryptocurrency miner, so review build artifacts as well. Good practice going forward is to pin third-party actions to a full commit SHA and to use short-lived tokens instead of classic personal access tokens wherever possible.
FAQ
What is the GhostAction campaign?
GhostAction is a supply chain attack operation that plants fake security audit workflows in GitHub repositories. It first came to light in September 2025 and has now resurfaced with new waves in October 2026.
How does the malicious GitHub Actions workflow work?
It is pushed to the default branch using a compromised maintainer account. The workflow runs on any push, collects named secrets, scans the working tree and full git history for 13 credential patterns, and sends the stolen data to an attacker-controlled IP address over plain HTTP.
Which credentials are at risk from GhostAction?
AWS keys, Anthropic, OpenAI and OpenRouter API keys, GitHub and GitLab tokens, SSH private keys, Azure credentials, DockerHub and GHCR registry credentials, database passwords, and bot tokens for services like Telegram, Slack and Discord.
How do I know if my repository is infected?
Look for workflow files named “security-audit.yml” or “github_actions_security.yml” added since August 31, 2026. If either exists and you did not create it, assume the repository is compromised.
What should I do after removing the malicious workflow?
Revoke the leaked GitHub credential, rotate every secret that was stored in the repository, delete the workflow from all branches, and inspect forks and build images for tampering such as hidden cryptocurrency miners.
