Recent GhostAction Campaign Compromises Over 500 GitHub Accounts: A Comprehensive Analysis
In a troubling development within the cybersecurity landscape, a new GhostAction campaign has compromised more than 500 GitHub accounts, injecting malicious workflows into tens of thousands of repositories since October 7, 2026. According to an update from Socket on October 9, this campaign focuses on credential theft, specifically targeting GitHub Actions secrets, cloud credentials, and AI service API keys that are embedded in source code and repository histories.
The statistics from an analysis conducted on October 8 reveal that an initial surge of this attack affected 346 repositories via compromised maintainer accounts known as henrywoo and kitao. The impact of this compromise is not only limited to individual projects but also raises concerns regarding organization-wide security, as it exposed how contributor permissions can lead to further account compromises in organization-owned projects. However, as of now, Socket has not established the method through which attackers gained access to the initial maintainer credentials.
The attackers executed their strategy by directly committing a malicious script named .github/workflows/security-audit.yml into the default branches of targeted repositories. The commit messages employed were seemingly innocuous phrases, such as “Add security audit workflow.” Nevertheless, behind this façade lies a serious threat; the malicious workflow is designed to harvest sensitive credentials. It operates on push events without imposing branch or path restrictions and can even be manually executed using the workflow_dispatch command, further complicating detection efforts.
Investigations suggest that the attackers meticulously analyzed existing workflows to identify Action secrets referenced within them. They appeared to have inserted these credentials into a reusable payload for their malicious activities. In the case of Pyxel, the workflow specifically targeted sensitive variables such as CARGO_REGISTRY_TOKEN, PERSONAL_ACCESS_TOKEN, PYPI_PASSWORD, and PYPI_USERNAME, thereby creating potential exposure across numerous platforms, including GitHub, PyPI, and crates.io. The uniformity of the payloads and the rapid deployment across repositories indicate a high level of automation in how these malicious activities are conducted.
The new iteration of the GhostAction campaign introduces a repository scanning stage, complementing its existing mechanism for obtaining Action secrets. This scanning process utilizes actions/checkout@v4 with the parameter fetch-depth: 0, allowing attackers to retrieve comprehensive history from multiple branches and tags. They then scrutinize working-tree files and patch outputs derived from git log -p --all, with a history buffer limited to 200,000 lines.
Thirteen distinct credential patterns have been identified, encompassing AWS access identifiers, secret keys and session tokens, API keys for services like Anthropic, OpenAI, and OpenRouter, as well as tokens for GitHub and GitLab and credentials for cloud services such as Google, Slack, and SendGrid. The historical scanning capabilities of this malicious payload could potentially expose secrets that were removed from current files yet still reside in reachable commits. Moreover, the payload cleverly captures two lines of context on either side of AWS access key identifiers, thereby providing adjacent secret access keys that attackers can exploit for gaining more comprehensive access.
Collected data, including repository identifiers, is then transmitted in cleartext via HTTP POST requests to the identified exfiltration server at hxxp://193.32.204[.]199/?c=monami. Socket has confirmed successful executions of the injected workflows in multiple affected repositories, with Pyxel serving as the most transparent example of this publishing-credential-targeting methodology. However, researchers have not found any malicious releases on PyPI or crates.io associated with the current activity, suggesting that the attackers may be in the preliminary stages of their exploit.
As organizations confront this rising tide of cybersecurity threats, Socket has advised a series of remedial actions. Defenders are urged to promptly eradicate injected workflows and to meticulously review execution logs. They should revoke access for any compromised accounts and rotate all exposed credentials to mitigate the damage inflicted by these attackers. It is crucial that responses are comprehensive, addressing both Actions secrets and any committed credentials while also considering historical exposures.
Socket further recommends auditing package releases and monitoring AWS CloudTrail activities. Organizations should take preventive measures by blocking the identified exfiltration address, enabling secret scanning with push protection features, and scrutinizing affected forks prior to permitting Actions. Additionally, comprehensive reviews of organization-wide account permissions should be conducted to bolster defenses against such attacks in the future.
In conclusion, the GhostAction campaign serves as a stark reminder of the vulnerabilities inherent within the widely-used GitHub platform. As attackers refine their strategies and leverage automation, organizations must adopt proactive security measures and be vigilant in defending against these sophisticated threats.