The cyber campaign known as GhostAction has intensified its efforts, impacting over 30,000 repositories linked to approximately 3,000 users and organizations on GitHub. This surge was closely monitored by GitGuardian on October 8 and 9, 2026.
Compromised Credentials and Repository Infiltration
Security analysts Gaetan Ferry and Guillaume Valadon have reported that around 1,900 GitHub accounts were breached, leading to attempts to extract secrets from continuous integration processes in public repositories. GhostAction, identified in September 2025, is a supply chain attack strategy that compromises developer accounts to insert harmful GitHub Actions workflows into software repositories.
The attackers effectively gain write access to repositories using Personal Access Tokens (PATs) or credentials from infostealer logs. They then deploy malicious workflow files under misleading names such as ‘security-audit.yml’ or ‘github_actions_security.yml’. The primary objective is the theft of crucial CI/CD secrets, cloud credentials, and API keys from various service providers.
New Wave of Attacks
A renewed series of attacks began on August 31, 2026, with malicious workflows being introduced to numerous repositories. GitGuardian observed that this wave appears more experimental, with the payload evolving over time. Initially, a secret-scanning feature was added to the payload, aimed at extracting AWS key IDs, GitHub, GitLab tokens, and other cloud API keys during a git history scan.
Subsequent versions of the payload included contextual information around AWS key IDs to associate them with their secret access keys. The latest variant further enhanced the secret retrieval process during the history scan.
Mitigation and Ongoing Threats
This payload deployment occurred in phases, initially targeting 160 known victims before expanding to 28,000 new repositories within a short span on October 8 and 9. Although GitHub intervened on October 9 to prevent the workflow from executing, additional waves were detected on October 10 and 12, albeit without success in secret extraction.
Notably, some victims in this recent surge had previously been impacted in earlier attacks in September 2025 and August 2026, suggesting the attackers are exploiting unrotated secrets.
The persistent nature of GhostAction highlights the ongoing risk of supply chain attacks and the necessity for developers to adopt robust security measures to protect their infrastructure. As the threat landscape evolves, vigilance and proactive defense strategies remain crucial.
