GhostAction returns: about 1,900 hijacked GitHub accounts pushed secret-stealing workflows to 30,000 repos
GitGuardian counts more than 30,000 repositories and about 1,900 compromised GitHub accounts in GhostAction's October wave, which committed workflows that dump Actions secrets and scan git history for credentials. Some victims were hit in 2025 and never rotated.
The GhostAction campaign, first reported in September 2025, came back in two waves this year. From August 31, GitGuardian saw a malicious workflow pushed to 772 public repositories belonging to 373 users and organizations. Then on October 8 and 9 activity spiked: GitGuardian now counts more than 30,000 repositories across roughly 3,000 owners, about 1,900 compromised accounts, and 3,174 targeted secrets. Commits were made under the victims' own identities with what GitGuardian calls apparently stolen credentials. The workflow, named security-audit.yml or github_actions_security.yml, runs on any push, dumps the repository's Actions secrets, scans the working tree and full git history for credential patterns including AWS, GitHub, GitLab and AI provider keys, and posts them over plain HTTP to a bare IP. GitHub began blocking the workflow from running on October 9, so later waves on October 10 and 12 extracted nothing.
Why it matters
Two identity failures stack here. The entry point is a stolen GitHub credential that can write workflow files, and the prize is every secret those workflows can read. GitGuardian found October victims who were also hit in September 2025 and August 2026, and 92 cases where the attacker simply edited a workflow left behind by an earlier wave. Secrets that were exposed and never rotated are the campaign's renewable resource.
If either filename appears in any branch since August 31, assume every repository secret and anything in git history is exposed. Revoke the GitHub token or PAT that made the commit (otherwise someone else will reuse it), rotate the secrets, remove the workflow from all branches, and check forks, which inherit it. Longer term, replace stored cloud keys with workload identity federation so there is nothing static to dump. See secrets in repositories and CI. The Hacker News covered the first October sweeps on October 9; GitGuardian's analysis is here.
Source: The Hacker News
Related on Start with Identity
- BlogA hijacked AI coding assistant session spread Shai-Hulud to about 100 internal repositories
Mandiant describes an intrusion at an unnamed SaaS provider where a poisoned package, recommended through a developer's AI coding assistant session, led to stol
- BlogAn encrypted web page tricked GitHub Copilot CLI into leaking a .env file
Adversa AI showed GitHub Copilot CLI in autopilot mode reading a local .env.prod file and sending its contents to an attacker URL after fetching a page with enc
- BlogCISA contractor left AWS GovCloud admin keys in a public GitHub repo for six months
844 MB of agency data in a repo named Private CISA, including a file called importantAWStokens and plaintext internal passwords. Nine automated GitGuardian aler
- CVEAuth0 node-jws HS256 verification bypass via secret lookup
node-jws before 3.2.3 / 4.0.1 can accept an HS256 JWT when the caller looks up the secret from attacker-controlled input. Medium on paper, but it is a signature
- GuideDevSecOps Identity Integration Guide: Securing CI/CD Pipelines and Developer Workflows
Integrate identity security into DevSecOps workflows covering CI/CD pipeline identity, secrets management, service account governance, and OIDC for GitHub Actio
- CVEGitHub Enterprise Server SAML bypass via libxml2 canonicalization
GitHub Enterprise Server accepted a crafted SAML response because libxml2 canonicalization quirks let the signed XML and the consumed XML diverge. High-severity