GhostAction Floods GitHub With 72,026 Malicious Commits Targeting CI and Developer Secrets

GhostAction expanded its credential-theft campaign across GitHub, pushing 72,026 malicious commits to 22,964 public repositories over nine days, according to GitGuardian research. Reporting also identified 1,792 compromised accounts, with substantial reuse of previously compromised accounts. Five payload families target GitHub-hosted and self-hosted CI runners, developer endpoints, and AWS roles accessible through GitHub OpenID Connect (OIDC). GhostAction adopted a launcher associated with PolinRider, and 188 GhostAction commits were subsequently pushed with PolinRider loaders, but researchers found no clear evidence linking the campaigns to the same operator.

GitHub blocked the malicious workflow executions observed by researchers, but that protection does not cover every execution path: a Node.js stealer disguised as a font file can run outside CI when a developer opens and trusts an affected repository in VS Code. Three GhostAction payloads also establish recurring cron-based persistence, meaning repository cleanup alone is insufficient. Affected organizations should revoke exposed credentials, investigate developer machines and self-hosted runners, remove persistence, and review AWS role access through GitHub OIDC.