GhostAction Hijacks 1,900 GitHub Accounts to Target Over 30,000 Repositories

The GhostAction credential-theft campaign used approximately 1,900 compromised GitHub accounts to inject malicious GitHub Actions workflows into more than 30,000 repositories. Its largest deployment, on October 8–9, affected repositories belonging to approximately 3,000 users and organizations and targeted 3,174 secrets for extraction. The workflows harvested CI/CD secrets and scanned repository contents and full Git histories for cloud credentials, personal access tokens, package registry tokens, and AI provider API keys, sending stolen credentials to 193.32.204.199 over HTTP. GitGuardian confirmed some October exfiltration, but the total number of credentials stolen remains unknown.

The campaign relied on stolen developer credentials, not a GitHub Actions vulnerability. A wave beginning August 31 introduced evolving secret-scanning payloads, and previously compromised victims reappeared, suggesting attackers continued to exploit unrotated secrets. GitHub approval controls blocked most malicious workflows in the earlier campaign, and GitHub began blocking malicious workflows in the October wave on October 9. Defenders should inspect repositories for unauthorized workflows, remove malicious additions, revoke compromised account credentials, and rotate potentially exposed secrets—including credentials retained in Git history.