A recent wave of cyberattacks has targeted 790 GitHub repositories, exploiting them to steal sensitive cloud credentials and API keys. This operation, known as GhostAction, involves the use of malicious GitHub Actions workflows to extract and transmit critical information, posing significant risks to affected repositories.
Understanding the GhostAction Campaign
GhostAction is an orchestrated effort by cybercriminals to infiltrate GitHub repositories by embedding harmful workflows. These workflows are designed to activate when code is pushed or manually triggered, potentially exposing sensitive data within the repository. Trusted developer accounts are particularly vulnerable, as attackers can add workflows that run under the guise of legitimate operations.
The campaign was uncovered by researchers from OpenSourceMalware while examining a malicious PyPI package named claudecord. Their investigation revealed that the malicious workflows were not only accessing secrets from GitHub Actions but also scanning repository files for strings resembling credentials, including those from major platforms such as AWS, Google, and OpenAI.
Techniques and Implications
The malicious workflows utilize a method called fetch-depth: 0 to retrieve the complete history of a repository. This allows attackers to find credential-like patterns and extract sensitive information that might have been removed from the current version of files but remains in older commits. Such exploits can lead to unauthorized access to cloud services, software registries, and more.
The compromised data is then sent to attacker-controlled servers via plain HTTP, masquerading as normal build activity. These stealthy operations make it challenging for defenders to detect the breaches unless they scrutinize workflow changes and monitor network traffic closely.
Preventive Measures and Future Outlook
To mitigate the risks posed by such attacks, it is crucial for teams to maintain records of workflow files, audit logs, and commits. Affected credentials should be revoked, and all secrets accessible by the workflow should be rotated. Additionally, organizations are advised to review package releases and cloud activity during the affected period.
GitHub’s security guidelines emphasize the importance of granting least-privilege access, regularly reviewing workflow code, and rotating any exposed secrets. Implementing approval processes for sensitive changes and restricting network access for CI runners can further enhance security.
As cyber threats continue to evolve, staying informed and updating defenses is paramount. Integrating threat intelligence feeds with existing security operations can help organizations respond swiftly to new malware threats and protect their critical assets.
