GhostAction Hackers Inject Malicious Security Workflows Into 790 GitHub Repositories

GhostAction has returned with an expanded credential-theft operation, injecting malicious GitHub Actions workflows into 790 repositories by October 9, 2026.

GitGuardian first documented GhostAction in 2025, when it reported 817 affected repositories and 3,325 stolen secrets.

The latest wave builds on the same account-takeover approach: attackers enumerate repositories a compromised maintainer can write to, then push a security-themed workflow directly sometimes to a default branch without a pull request or review.

Workflows trigger on pushes or manual execution, giving attackers an opportunity to collect secrets available to GitHub Actions.

Earlier payloads were tailored to named secrets found in repositories’ legitimate workflows, including package-publishing, cloud and GitHub credentials access.

The October variant broadens collection. Its security-audit.yml workflow checks out the full repository history with fetch-depth: 0, searches the working tree and reachable Git history for credential patterns, and captures surrounding context for AWS key identifiers.

That can expose credentials committed long ago and later deleted from the visible files. The collected data is sent over unencrypted HTTP to 193.32.204[.]199, including through the reported /?c=monami endpoint.

Socket and StepSecurity documented two automated injection bursts on October 8.

The first involved 27 repositories associated with the compromised kitao account; the second involved 318 repositories associated with henrywoo, including 279 forks and Uber’s uber/athenadriver.

Researchers also found a separate set of campaign-related injections, bringing OpenSourceMalware’s validated total to 790.

These counts reflect different collection windows and methods: Socket and StepSecurity’s 346-repository snapshot describes the two October 8 bursts, while the broader dataset includes additional validated repositories and earlier activity.

The inclusion of long-dormant projects and numerous forks suggests automated enumeration of writable repositories rather than careful selection of active targets.

Opensource malware Researchers said that, the campaign abuses compromised developer accounts to add workflows that can run automatically, steal CI/CD secrets and search current source code and Git history for credentials.

GhostAction Campaign

In the uber/athenadriver case, StepSecurity reported that the workflow was pushed directly to the master branch under the maintainer’s identity, without a pull request or review.

It also reported an execution in which the exfiltration request reached the collector.

Socket found successful workflow executions as well, but reported no malicious PyPI or crates.io releases attributable to the observed October wave at publication time. That absence does not establish that exposed credentials are safe.

GhostAction’s initial 2025 payload focused on secrets available to GitHub Actions.

The new history-mining capability reaches a broader set of credentials, including AWS, GitHub and GitLab tokens, and AI-service keys.

This changes the remediation picture: removing a secret from the latest version of a repository does not remove it from its history, and deleting the malicious workflow does not revoke credentials already collected.

OpenSourceMalware also flagged two recently registered, code-hosting-themed domains: my-gitlab[.]com and my-github[.]com.

The latter resolves to the reported collector IP, making it a higher-priority indicator. The GitLab-themed domain points to separate infrastructure, and its relationship to GhostAction is unproven.

The names and timing justify monitoring, but they are not evidence that both domains belong to the same operator or have been used in phishing.

Organizations should search repositories, workflow files and commit history for 193.32.204[.]199, security-audit.yml, github_actions_security.yml, and distinctive payload markers such as AKIA_CTX_START and ?c=monami.

Review workflow runs and account audit logs for unexpected commits, rapid pushes across multiple repositories, manual workflow dispatches and outbound connections from runners to the collector.

If a malicious workflow or successful run is found, remove it across affected branches and forks, revoke the compromised account’s tokens and sessions, and rotate every exposed secret.

That includes credentials named in the workflow and credentials that may have appeared anywhere in the repository’s history. Review package releases, cloud activity and other services tied to those credentials for unauthorized use.

The central lesson is that a trusted maintainer identity does not make a workflow change trustworthy.

Requiring review for changes under .github/workflows/, restricting runner egress to approved destinations and limiting secrets to the jobs that need them can help interrupt the chain before a compromised account becomes a wider supply-chain incident.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.