GhostAction Steals CI and AI Secrets via GitHub Actions

GhostAction compromised GitHub accounts and planted Actions workflows to steal cloud, package, and AI credentials; sources disagree on scale.

Socket, cited by GBHackers on October 10, said the GhostAction campaign compromised more than 500 GitHub accounts and injected malicious GitHub Actions workflows into tens of thousands of repositories since October 7, 2026. GitGuardian, cited by The Hacker News on October 15, reported about 1,900 accounts compromised on October 8–9 and more than 30,000 repositories across 3,000 users and organizations, with 3,174 CI secrets targeted. Attackers used stolen personal access tokens or infostealer credentials to push workflows disguised as security audits, including security-audit.yml, which run on push, harvest Actions secrets, and scan git history for cloud, source-control, package, and AI API keys. Socket reported successful runs against kitao/pyxel and uber/athenadriver and cleartext HTTP POST exfiltration to 193.32.204.199, and said no malicious PyPI or crates.io releases had been observed. GitGuardian said GitHub began blocking the workflow on October 9, so later waves on October 10 and 12 extracted no secrets, and that repeat victims suggest unrotated secrets were reused. The sources disagree on compromised-account counts (more than 500 versus about 1,900) and on the start date (October 7 versus October 8–9).

• Socket, via GBHackers on 2026-10-10, said GhostAction compromised more than 500 GitHub accounts and injected malicious workflows into tens of thousands of repositories since 2026-10-07.
• GitGuardian, via The Hacker News on 2026-10-15, said about 1,900 accounts were compromised on 2026-10-08 and 2026-10-09, targeting more than 30,000 repositories across 3,000 users and organizations and 3,174 CI secrets.
• Attackers used stolen personal access tokens or infostealer credentials to push workflows disguised as security audits, including security-audit.yml, which run on push, steal Actions secrets, and scan git history.
• Credentials sought included AWS, Anthropic, OpenAI, OpenRouter, GitHub, GitLab, Google, Slack, SendGrid, npm, PyPI, and DockerHub tokens; newer payloads capture context around AWS key IDs.
• Socket said data was sent by cleartext HTTP POST to 193.32.204.199, with successful runs including kitao/pyxel and uber/athenadriver, and no malicious PyPI or crates.io releases observed.
• GitGuardian said GitHub began blocking the workflow on 2026-10-09, so waves on 2026-10-10 and 2026-10-12 extracted no secrets; repeat victims suggest unrotated secrets.