Loading story…
The GhostAction supply-chain campaign compromised 772 public GitHub repositories across 373 users and organizations between August 31 and September 30, 2026, targeting 2,577 CI/CD secrets. Attackers used stolen GitHub account access to inject legitimate-looking GitHub Actions workflows that collected selected secrets and sent them to attacker-controlled infrastructure. GitGuardian reported 336 successful malicious workflow runs and confirmed the theft of 26 secrets from 13 repositories; GitHub held most reviewed runs for approval, limiting execution.
Attackers also updated malicious workflows left behind by earlier campaign waves, demonstrating persistence. As of October 5, only 16% of affected repositories showed effective cleanup in public commit history, leaving uncertainty about remediation elsewhere. Affected organizations should remove malicious workflows, revoke compromised GitHub credentials, rotate potentially exposed secrets, and investigate repository access and workflow execution history. Defensive priorities, consistent with GitHub’s secure-use guidance, include least-privilege workflow permissions, stronger approval and workflow-change review controls, and hardened account security.
Trace attribution and downstream blast radius.
13 events from the most recent confirmed update back to the earliest known activity.
As of October 9, 2026, Socket had identified more than 500 GitHub accounts that committed malicious workflows to tens of thousands of repositories since October 7. Its findings substantially expanded the reported scope of the ongoing GhostAction credential-theft campaign.
On October 8, 2026, attackers used compromised maintainer accounts henrywoo and kitao to inject malicious security-audit.yml workflows into 346 repositories, including uber/athenadriver and kitao/pyxel. The workflows expanded beyond GitHub Actions secrets to scan source files and Git history for cloud, AI-service, source-control, and SaaS credentials, sending collected data in cleartext to 193.32.204[.]199.
On October 7, 2026, attackers using the compromised xxyangyoulin account attempted to retrigger the malicious typecho-fans/plugins workflow through an empty commit and a subsequent README edit. Both runs stopped in action_required because workflow approval was required, preventing execution.
GitGuardian recorded a further GhostAction activity burst affecting 103 public GitHub repositories on September 15.
GhostAction compromised 294 repositories on September 5, within a September 2–5 burst affecting roughly 400 repositories.
GhostAction affected 143 public GitHub repositories in a single activity burst. Attackers used stolen GitHub account access to inject malicious GitHub Actions workflows under victims' identities.
GhostAction used 170[.]39[.]218[.]2 for credential collection in March 2026, following its use during October–December 2025.
The attacker-controlled endpoint bold-dhawan.45-139-104-115.plesk.page stopped resolving at 16:15 UTC on September 5, 2025, shortly after public disclosure. Malicious GitHub Actions workflows had used the endpoint to receive stolen repository secrets.
GitGuardian disclosed GhostAction after the campaign compromised 817 public GitHub repositories and collected at least 3,325 secrets.
GitGuardian found cryptomining activity in kuafuai/DevOpsGPT, a repository subsequently affected by GhostAction, involving an XMRig binary disguised as /usr/local/bin/pyworker. Researchers did not attribute the two compromises to the same operator, citing differences in operational style.
GitGuardian's investigation identified 772 repositories compromised between August 31 and September 30, 2026, with 2,577 secrets targeted across 373 users and organizations. Reviewing 3,669 workflow runs, it found that most were held for approval, but 336 completed successfully and enabled confirmed theft of 26 secrets from 13 repositories.
Cynative researchers independently identified suspicious GitHub commits and contacted GitGuardian, prompting its investigation into the latest GhostAction activity.
During the latest wave, attackers updated existing malicious workflows in 92 cases rather than creating new ones, redirecting credential collection to 193[.]32[.]204[.]199. The workflows collected selected GitHub Actions secrets after legitimate repository pushes and transmitted them through HTTP POST requests.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 12 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
10 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcecryptika.com
Open sourcecybersecuritynews.com
Open sourcestepsecurity.io
Open sourcecybersecuritynews.com
Open sourceblog.gitguardian.com
Open sourcedocs.github.com
Open sourcestepsecurity.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **GhostAction** supply-chain campaign compromised 327 GitHub users and inserted malicious workflows into 817 repositories, stealing 3,325 CI/CD secrets. Workflows masquerading as “Github Actions Security” sent PyPI, npm, DockerHub, GitHub, AWS, database, and Cloudflare credentials by HTTP POST to attacker infrastructure, including `45.139.104.115`; a later wave added exfiltration domains and hundreds of commits. Although no malicious package releases had been confirmed at disclosure, 24 affected packages—nine npm and 15 PyPI—remained at immediate risk, while some stolen credentials were reportedly already abused. CI/CD workflows are also vulnerable to remote-code-execution exposure from unsafe `pull_request_target` configurations, artifact-token leaks such as **ArtiPACKED**, and attacks including **HackerBot-Claw**. Elastic Security Labs released the open-source `cicd-abuse-detector` to review GitHub Actions, GitLab CI, and Azure DevOps changes before merge or deployment, extracting more than 50 signals from pipeline files and analyzing diffs for secret exfiltration, privileged pull-request triggers, permission escalation, self-hosted-runner targeting, supply-chain manipulation, and timestamp abuse. The tool can issue pull-request, issue, Slack, and Elasticsearch alerts and optionally block risky pull requests.
Sep 9, 2026The widely used GitHub Action **`tj-actions/changed-files`** was compromised after an attacker gained write access to the repository and retargeted release tags to a malicious orphaned commit, causing workflows pinned to tags rather than immutable SHAs to run attacker-controlled code. The backdoor downloaded and executed a remote payload that scraped decrypted GitHub Actions secrets from process memory and printed them into workflow logs, exposing repositories that executed the action and creating acute risk for public projects where logs were openly accessible. The incident was detected after anomalous outbound network activity was observed, and the maintainer removed the malicious changes soon afterward. Follow-on analysis found the blast radius was substantial because the action was referenced across roughly **23,000 repositories** and many workflows were not pinned to a full commit hash. GitGuardian reported that among workflows executed during the compromise window, hundreds showed signs of exploitation and **603 secrets** were exposed in logs, including temporary GitHub tokens, DockerHub credentials, AWS keys, GitHub personal access tokens, Jira tokens, and cloud.gov credentials. Organizations using the action were urged to review workflow runs from March 14 onward, delete affected logs, rotate any exposed credentials, audit dependencies and commits, and pin third-party GitHub Actions to full commit SHAs to reduce future supply-chain risk.
Jun 29, 2026
Researchers reported that the `prt-scan` campaign abused misconfigured GitHub Actions workflows using the `pull_request_target` trigger to run attacker-controlled code from forked pull requests in privileged CI contexts. The actor used at least six GitHub accounts to submit more than 500 malicious pull requests across six waves, disguising many as routine CI updates and tailoring payloads to Python, Node.js, Go, Rust, and GitHub Actions repositories. Wiz said the operation evolved from simple bash payloads into AI-assisted, repository-aware implants designed to steal `GITHUB_TOKEN` values, enumerate secrets, probe cloud metadata services, and exfiltrate credentials through workflow logs and pull request comments. The campaign succeeded often enough to cause real supply-chain impact despite an estimated success rate below 10%. Wiz confirmed compromise of the npm packages **`@codfish/eslint-config`** and **`@codfish/actions`** across 106 versions, and verified theft of AWS keys, Cloudflare API tokens, and Netlify authentication tokens. High-profile projects including Sentry, OpenSearch, IPFS, NixOS, Jina AI, and recharts reportedly blocked the attempts through contributor approval gates and workflow restrictions. The activity follows earlier warnings from Sysdig that insecure use of `pull_request_target` in prominent repositories such as MITRE, Splunk, and Spotipy could expose secrets and high-privilege `GITHUB_TOKEN` permissions, underscoring that unsafe GitHub Actions defaults remain an active software supply-chain risk.
Jun 29, 2026