GhostAction campaign hits 500+ GitHub accounts with secret-stealing workflows
Original title: GhostAction Hackers Compromise 500+ GitHub Accounts to Steal AWS, OpenAI, and Cloud Credentials
Hijacked maintainers added security-audit.yml from October 7 and sent secrets in plaintext to 193.32.204.199.
Socket says more than 500 GitHub accounts were used from October 7, 2026, to commit a fake security-audit.yml workflow. The file harvests named secrets, nearby AWS key material, and keys left in git history, then sends them in plaintext to 193.32.204[.]199. Named repositories include Uber’s athenadriver and the Pyxel engine. As of October 9 the file remained on checked default branches and had run; Socket had not seen malicious PyPI or crates.io releases.
Unconfirmed: Socket did not determine how the logins were stolen and has not confirmed the collected keys were used.
- henrywoo and kitao pushed the file into 346 repositories on October 8.
- The workflow sets fetch-depth to 0 and copies two lines around each AWS key ID.
- OpenSourceMalware counted 790 repositories carrying the workflow through October 9.
- Pyxel secrets named in the file included PyPI, crates.io, and a GitHub token.
- A September 2025 wave took 3,325 Actions secrets from 817 repositories.
Impact: Theft of cloud, AI, and package-publishing credentials
- 1.Inspect .github/workflows/security-audit.yml and rotate every secret it names, including GitHub tokens.
- 2.Scan full git history, review Actions runs, and rotate any keys still present in old commits.
- 3.Revoke the maintainer’s sessions, tokens, OAuth grants, and SSH keys, and block 193.32.204.199.
- Products
- GitHub Actions
- Threat actors
- GhostAction
- Victims
- Uber
- Organizations
- SocketGitGuardianOpenSourceMalware
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 193.32.204.199 | ch the organization audit log for new workflow files. Block 193.32.204[.]199 in egress logs, including self-hosted runners. Finally, t |
From the original article
4 min read at cybersecuritynews.com
A new wave of the GhostAction campaign has hit more than 500 GitHub accounts. The attackers use those accounts to plant a fake security workflow in tens of thousands of repositories, and the workflow steals cloud, AI, and publishing keys. Security firm Socket reports that the accounts added the malicious file starting October 7, 2026, […]
By Kavichselvan · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.