Skip to content
NewA calmer, faster ZeroHour
StoryMalwarehigh

GhostAction steals GitHub secrets via workflows, then phishing

3 sources · 3 articlesFirst reported Updated ()
What's new

October 20: GBHackers and Cyber Security News added OpenSourceMalware’s 790-repository count through October 9, the October 8 burst, and no linked PyPI or crates.io releases.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

GhostAction pushed credential-harvesting GitHub Actions into 790 repositories and later phished maintainers with a font-disguised stealer.

GhostAction used compromised maintainer accounts to add security-themed GitHub Actions workflows that scan files and full git history for cloud, publishing, and AI credentials, then send them over plain HTTP to 193.32.204.199. OpenSourceMalware validated 790 affected repositories through October 9, 2026, when The Hacker News says GitHub began blocking the workflow. The operator then phished maintainers from noreply@my-github.com, capturing passwords, 2FA codes, and an OAuth device-flow grant, and planted a VS Code task disguised as a font in 94 repositories across 66 owners. Socket and Cyber Security News reported workflow runs but no malicious PyPI or crates.io releases linked to the October wave. The Hacker News says my-github.com was registered on October 9; Cyber Security News says that registration is unproven.

Key facts
  • OpenSourceMalware validated 790 repositories with malicious workflows through October 9, 2026.
  • Later phishing phase affected 94 repositories across 66 owners.
  • Collected data is sent to 193.32.204.199, including plain HTTP on port 8080.
  • The OAuth grant requests repo, workflow, and read:org scopes.
  • October 8 burst included Uber’s uber/athenadriver among henrywoo-linked repositories.
  • Deleting the workflow does not revoke secrets already taken from git history.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 8, 2026Workflow burst hit kitao, henrywoo, and Uber repos · GBHackers
  2. Oct 9, 2026GitHub began blocking the malicious workflow · The Hacker News
  3. Oct 9, 2026OpenSourceMalware validated 790 affected repositories · GBHackers
  4. Oct 9, 2026my-github.com registered and pointed at collector IP · The Hacker News

What each outlet adds

beyond the shared facts
  • The Hacker NewsPhishing flow, font stealer, 94 repos, and OAuth scopes.
  • GBHackersOctober 8 owner breakdown, GitGuardian 2025 totals, and my-gitlab.com unproven.
  • Cyber Security News772-repo window, targeted secret types, and claudecord 0.3.2 lead.
Vendors
GitHubMicrosoft
Products
GitHub ActionsPyPIGitHubVisual Studio Code
Threat actors
GhostAction
Malware
GhostActionclaudecord
Victims
Uber
Organizations
GitGuardianSocketStepSecurityOpenSourceMalware

Coverage

oldest first · one row per article · UTC
  1. · 6d ago The Hacker NewsFirst report

    GhostAction plants font-disguised stealer in 94 GitHub repositories

    Phishing via my-github.com steals GitHub passwords, 2FA, and OAuth tokens, then a VS Code task runs a credential stealer.

  2. · 5d ago GBHackers

    GhostAction plants malicious workflows in 790 GitHub repositories

    October payloads mine full Git history for cloud and AI keys and post them over HTTP to 193.32.204.199.

  3. · 5d ago Cyber Security News

    GhostAction workflows in 790 GitHub repos hunt cloud and AI keys

    OpenSourceMalware's count through October 9 is validated public repos, not proof that every one leaked secrets.