In a significant cybersecurity breach, researchers have revealed an active campaign targeting GitHub repositories, exploiting a vulnerability in GitHub Actions to steal credentials. This campaign has compromised accounts of key open-source maintainers, affecting over 340 repositories with malicious workflows.
Details of the Cyberattack
The attack began with the compromise of Takashi Kitao’s account, the creator of the popular game engine Pyxel, where a harmful workflow was pushed to 27 repositories. Just hours later, Henry Wu’s account, known for Uber’s AthenaDriver, was used to distribute the same workflow to 318 additional repositories in a rapid 16-minute attack.
As of October 9, 2026, cybersecurity firm Socket has identified over 500 GitHub accounts involved in disseminating the malicious workflow across tens of thousands of repositories since October 7, 2026. The campaign, known as GhostAction, is a continuation of a larger supply chain attack first detected in September 2025.
Mechanics of the Workflow Attack
The malicious workflows, named “Security Audit” and “GitHub Actions Security,” were engineered to extract sensitive information by sending it to a predefined IP address. These workflows targeted GitHub Actions secrets and included vital credentials such as AWS keys, as well as tokens for platforms like PyPI, npm, DockerHub, and others.
The attack strategy involved leveraging leaked personal access tokens to gain access to maintainer accounts. Once inside, attackers inserted a rogue workflow into the default branch of the repositories. This workflow scanned for and exfiltrated secrets through a series of steps designed to avoid detection.
Impact and Recommendations
GitGuardian reported that between August 31 and September 30, 2026, the GhostAction campaign targeted 772 public repositories, exfiltrating thousands of secrets, including SSH keys and various cloud service credentials. In one instance, attackers added a cryptocurrency miner to a project’s Docker image.
Developers are urged to inspect their repositories for these workflows and assume compromise if found. Immediate actions include revoking affected credentials, deleting malicious workflows from all branches, and reviewing forks that might inherit the malicious code. Notably, private forks are particularly vulnerable, as they often contain sensitive data.
In conclusion, the GitHub Action vulnerability underscores the importance of vigilant security practices in open-source development. As attackers continue to exploit these vulnerabilities, developers must remain proactive in safeguarding their projects.
