Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories
GhostAction compromised maintainer accounts to plant credential-stealing GitHub Actions workflows in tens of thousands of repositories.
Researchers disclosed an ongoing GhostAction supply-chain campaign that used compromised maintainer accounts to commit credential-stealing GitHub Actions workflows. Takashi Kitao’s pyxel account pushed the workflow to 27 repositories, and Henry Wu’s account then pushed it to 318 repositories in 16 minutes. Socket said more than 500 GitHub accounts had committed the workflow to tens of thousands of repositories since October 7, 2026, sending secrets—including AWS, OpenAI, Anthropic, and GitHub tokens—to 193.32.204.199 over HTTP. An earlier wave affected 817 repositories and 3,325 secrets, and one repository’s Docker image was altered to include XMRig; no malicious package releases were observed.
- Compromised pyxel and athenadriver maintainer accounts pushed malicious workflows.
- Over 500 accounts planted workflows in tens of thousands of repositories.
- Workflows steal CI, cloud, AI, and SaaS secrets via plain HTTP.
- Earlier wave exfiltrated 3,325 secrets from 817 repositories.
- One repository's Docker image was altered to include XMRig.
- ATT&CK
- T1078.004 Cloud AccountsT1195.002 Compromise Software Supply ChainT1552.001 Credentials In FilesT1048.003 Exfiltration Over Unencrypted Non-C2 ProtocolT1496 Resource Hijacking
- Vendors
- GitHub
- Products
- GitHub Actionspyxelathenadriver
- Threat actors
- GhostAction
- Malware
- XMRig
- Organizations
- StepSecuritySocketGitGuardian
From the original article
3 min read at thehackernews.com
Cybersecurity researchers have disclosed details of an ongoing credential-theft campaign that has compromised two high-profile open-source maintainer accounts to push a malicious workflow into over 340 repositories. "Using the account of Takashi Kitao, author of the 18,400-star game engine pyxel, the attacker pushed a malicious workflow to 27 repositories starting at 13:20 UTC," StepSecurity
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.