GhostAction plants malicious workflows in 790 GitHub repositories
Original title: GhostAction Hackers Inject Malicious Security Workflows Into 790 GitHub Repositories
October payloads mine full Git history for cloud and AI keys and post them over HTTP to 193.32.204.199.
GhostAction has resumed using compromised maintainer accounts to push security-themed GitHub Actions workflows, sometimes directly to a default branch without review. By October 9, 2026, OpenSourceMalware had validated 790 affected repositories. The new security-audit.yml workflow checks out full history, searches for credential patterns including AWS key context, and sends results unencrypted to 193.32.204.199. Socket reported successful runs but no malicious PyPI or crates.io releases from the October wave at publication time.
Unconfirmed: Repository totals differ by collection window, and my-gitlab.com’s tie to GhostAction is unproven.
- October 8 bursts covered 27 kitao repositories and 318 linked to henrywoo, including Uber’s uber/athenadriver.
- GitGuardian’s 2025 report counted 817 repositories and 3,325 stolen secrets.
- my-github.com resolves to the collector IP; a link for my-gitlab.com is unproven.
- Deleting the workflow does not revoke secrets already collected from Git history.
Impact: CI secrets and historical cloud, Git and AI credentials stolen
| Product | Affected |
|---|---|
| GitHub Actions | — |
- 1.Search repos, workflows and history for 193.32.204.199, security-audit.yml, github_actions_security.yml, AKIA_CTX_START and ?c=monami.
- 2.Remove malicious workflows on branches and forks, revoke compromised tokens and rotate every exposed secret.
- 3.Require review for .github/workflows changes, restrict runner egress and limit secrets to needed jobs.
- ATT&CK
- T1078 Valid AccountsT1195.002 Compromise Software Supply ChainT1552.001 Credentials In FilesT1048 Exfiltration Over Alternative Protocol
- Vendors
- GitHub
- Products
- GitHub Actions
- Threat actors
- GhostAction
- Victims
- Uber
- Organizations
- GitGuardianSocketStepSecurityOpenSourceMalware
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | crates.io | kflow executions as well, but reported no malicious PyPI or crates.io releases attributable to the observed October wave at publi |
| domain | my-github.com | egistered, code-hosting-themed domains: my-gitlab[.]com and my-github[.]com . The latter resolves to the reported collector IP, makin |
| domain | my-gitlab.com | agged two recently registered, code-hosting-themed domains: my-gitlab[.]com and my-github[.]com . The latter resolves to the reported |
| ipv4 | 193.32.204.199 | files. The collected data is sent over unencrypted HTTP to 193.32.204[.]199 , including through the reported /?c=monami endpoint. Soc |
From the original article
3 min read at gbhackers.com
GhostAction has returned with an expanded credential-theft operation, injecting malicious GitHub Actions workflows into 790 repositories by October 9, 2026. GitGuardian first documented GhostAction in 2025, when it reported 817 affected repositories and 3,325 stolen secrets. The latest wave builds on the same account-takeover approach: attackers enumerate repositories a compromised maintainer can write to, then […]
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.