Skip to content
NewA calmer, faster ZeroHour
StoryData breachhighExploited in the wild

GhostAction plants credential-stealing workflows in tens of thousands of GitHub repos

2 sources · 2 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

A GhostAction variant has planted credential-stealing GitHub Actions workflows across tens of thousands of repositories.

A GhostAction campaign is injecting a GitHub Actions workflow named security-audit.yml into tens of thousands of repositories, including organization projects such as Uber’s uber/athenadriver. GBHackers reports more than 30,000 repositories across 3,000 users and more than 500 compromised accounts since October 2026. According to Socket, accounts henrywoo and kitao pushed the workflow on October 8 in commits labeled as routine security audits. The workflow triggers on push or manual dispatch, matches patterns for AWS, Anthropic, OpenAI, and GitHub secrets, scans full Git history, and posts data to 193.32.204.199 over HTTP. As of October 9 the workflow remained on examined default branches and had run; Socket had not seen follow-on malicious PyPI or crates.io releases.

Key facts
  • The malicious workflow is .github/workflows/security-audit.yml.
  • GBHackers counts over 30,000 repositories, 3,000 users and 500-plus accounts.
  • Payload uses 13 regexes, including AWS AKIA keys, and fetch-depth 0.
  • Stolen data is posted to 193.32.204.199 over HTTP.
  • Earlier GhostAction waves hit 817 repositories, according to GBHackers.
  • Socket found no follow-on malicious PyPI or crates.io releases as of October 9.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 8, 2026henrywoo and kitao pushed security-audit.yml workflows. · Infosecurity Magazine
  2. Oct 9, 2026Workflow remained on default branches and had executed. · Infosecurity Magazine

What each outlet adds

beyond the shared facts
  • GBHackersGives repo, user and account counts, 13 regexes and earlier 817-repo wave.
  • Infosecurity MagazineNames pushing accounts, Uber repo, October 8–9 status and no package follow-on.
Vendors
GitHub
Products
ActionsCI/CDGitHub Actions
Threat actors
GhostAction
Malware
GhostAction
Victims
Uber
Organizations
GitGuardianSocket

Coverage

oldest first · one row per article · UTC
  1. · 4h ago GBHackersFirst report

    GhostAction Targets GitHub Repositories for Credentials

    Malicious workflows in 30,000+ GitHub repositories steal AWS, AI, and other keys by scanning commit history.

  2. · 1h ago Infosecurity Magazine

    GhostAction variant steals secrets via workflows in tens of thousands of GitHub repos

    Accounts henrywoo and kitao added the workflow on October 8; it exfiltrates secrets over HTTP and scans Git history.