GhostAction returns: hijacked GitHub accounts push secret-stealing workflows
GitGuardian reported on October 7, 2026 a new GhostAction wave that began August 31 and spiked on October 8 and 9, when commits from about 1,900 compromised GitHub accounts added workflows to more than 30,000 repositories that dump Actions secrets and scan git history for credentials. GitGuardian did not determine how the accounts were compromised; some victims had been hit in the 2025 GhostAction campaign and never rotated their secrets. GitHub blocked the workflow from running starting October 9.
- Victim
- Multiple: about 1,900 GitHub accounts and more than 30,000 repositories
- Industry
- Technology
- Country
- Global
- Intrusion began
- Aug 31, 2026
- First disclosed
- Oct 7, 2026
- Actor
- GhostAction operators (unattributed) (Unattributed)
- Initial access
- Stolen credentials
- Identity control that failed
- Credential storage
- MFA
- Not disclosed
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
Compromised developer accounts were used to reach CI secrets, and secrets left unrotated after the 2025 wave were still usable. Rotation after any exposure, environment-protected secrets and OIDC-based short-lived cloud credentials in CI shrink what a push can steal.
Go deeper on SWI
- Technique: Secrets in repositories and CI
- SWI coverage: ghostaction returns with 1900 hijacked github accounts and 30000 repos
Sources
- GhostAction Returns: 772 Repos Hit, 30k More in Oct, GitGuardian, Oct 7, 2026
- GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories, The Hacker News, Oct 15, 2026
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- LastPass customer vault backup theft via engineer credentials and trusted device cookie 2022 · Stolen credentials
- Nikkei Slack workspace accessed with credentials stolen by malware 2025 · Stolen credentials
- Nx s1ngularity npm compromise harvests developer secrets with AI CLIs 2025 · Supply chain
- Internet Archive user database theft and Zendesk token abuse 2024 · Exposed secrets
Cite this record
SWI Community Team. (2026). GhostAction returns: hijacked GitHub accounts push secret-stealing workflows. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2026-ghostaction-github-actions-secrets-wave/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.