# GhostAction returns: about 1,900 hijacked GitHub accounts pushed secret-stealing workflows to 30,000 repos

Source: https://startwithidentity.com/blog/2026-10-15-ghostaction-returns-with-1900-hijacked-github-accounts-and-30000-repos/
Last updated: 2026-10-15
License: content by Start with Identity. Cite the source URL.

---

The GhostAction campaign, first reported in September 2025, came back in two waves this year. From August 31, [GitGuardian](https://startwithidentity.com/vendors/secrets/gitguardian/) saw a malicious workflow pushed to 772 public repositories belonging to 373 users and organizations. Then on October 8 and 9 activity spiked: GitGuardian now counts more than 30,000 repositories across roughly 3,000 owners, about 1,900 compromised accounts, and 3,174 targeted secrets. Commits were made under the victims' own identities with what GitGuardian calls apparently stolen credentials. The workflow, named `security-audit.yml` or `github_actions_security.yml`, runs on any push, dumps the repository's Actions secrets, scans the working tree and full git history for credential patterns including AWS, GitHub, GitLab and AI provider keys, and posts them over plain HTTP to a bare IP. GitHub began blocking the workflow from running on October 9, so later waves on October 10 and 12 extracted nothing.

## Why it matters

Two identity failures stack here. The entry point is a stolen GitHub credential that can write workflow files, and the prize is every secret those workflows can read. GitGuardian found October victims who were also hit in September 2025 and August 2026, and 92 cases where the attacker simply edited a workflow left behind by an earlier wave. Secrets that were exposed and never rotated are the campaign's renewable resource.

If either filename appears in any branch since August 31, assume every repository secret and anything in git history is exposed. Revoke the GitHub token or PAT that made the commit (otherwise someone else will reuse it), rotate the secrets, remove the workflow from all branches, and check forks, which inherit it. Longer term, replace stored cloud keys with [workload identity federation](https://startwithidentity.com/glossary/workload-identity-federation/) so there is nothing static to dump. See [secrets in repositories and CI](https://startwithidentity.com/techniques/secrets-in-repositories-and-ci/). The Hacker News covered the [first October sweeps](https://thehackernews.com/2026/10/credential-stealing-github-actions.html) on October 9; GitGuardian's analysis is [here](https://blog.gitguardian.com/ghostaction-github-actions-supply-chain-attack-returns/).

Source: [The Hacker News](https://thehackernews.com/2026/10/ghostaction-compromises-about-1900.html)