The recent GhostAction campaign has compromised over 500 GitHub accounts, utilizing them to implant fraudulent security workflows in numerous repositories. These workflows are designed to exfiltrate cloud credentials, AI keys, and other sensitive data.
Details of the GhostAction Campaign
According to cybersecurity firm Socket, the malicious files began appearing in repositories on October 7, 2026. The targeted repositories include those from significant organizations. The compromised accounts added files that falsely claimed to conduct security audits but instead extracted sensitive information.
On October 8, 2026, two compromised accounts, henrywoo and kitao, were observed adding a file named security-audit.yml to 346 repositories. The commit messages misleadingly referenced a security audit workflow. This file transmitted collected data to an IP address, compromising sensitive credentials.
Impact and Methodology of the Attack
The attackers first gain access to a maintainer’s account, though the method remains unclear. They then search the repository for secret names used in workflows and embed these into the malicious file, which is committed directly to the default branch.
The attack’s efficiency suggests automation, with changes appearing in a short timeframe across multiple repositories, including dormant ones. Earlier instances of GhostAction primarily focused on extracting secrets stored within GitHub Actions.
Security Implications and Recommendations
The campaign targets a variety of keys, including AWS, OpenAI, and other significant API tokens. The malicious script also captures contextual lines around key IDs, allowing attackers to reconstruct complete key pairs.
Developers are advised to review their repositories for the presence of the security-audit.yml file, rotate any exposed secrets, and implement phishing-resistant multi-factor authentication. Blocking suspicious IPs and enabling GitHub’s secret scanning can further mitigate risks.
As of October 9, 2026, compromised files remain active in several repositories, with no evidence of misuse of the stolen keys yet. However, the threat persists, and proactive measures are essential to secure sensitive information.
