What happened
On October 8, 2026 (UTC), the GhostAction campaign hijacked two well-known open-source maintainer accounts and used them to push a malicious GitHub Actions workflow named security-audit.yml into about 345 repositories:
- the account of Takashi Kitao, author of the pyxel game engine (~18.4k stars), pushed it to 27 repositories;
- hours later, the account of Henry Wu (henrywoo), original author of Uber's athenadriver, pushed it to 318 repositories in 16 minutes, under 3 seconds per repo, a sign of automation. That included
uber/athenadriver, Uber's own repo, where he had write access.
Per Socket, by October 9 more than 500 GitHub accounts had committed the workflow to tens of thousands of repositories since October 7.
What the workflow steals
Disguised as a "security audit," it runs on push and:
- harvests GitHub Actions secrets;
- sweeps the working tree and the full git history for forgotten credentials;
- sends everything in cleartext over HTTP to a hardcoded IP (193.32.204.199).
Targets include PyPI, npm and Docker Hub tokens, AWS, Azure and Google Cloud/Firebase keys, GitHub and GitLab tokens, SSH keys, Slack/Telegram/Discord bot tokens, Cloudflare keys and AI API keys (OpenAI, Anthropic, OpenRouter).
Not the first wave
GhostAction surfaced in September 2025, hitting 817 repos and stealing 3,325 secrets. GitGuardian counted another wave between August 31 and September 30, 2026: 772 repos and 2,577 secrets targeted. In 92 cases the attacker didn't add a file at all: it modified workflows planted in earlier waves and never removed, pointing them at the new server.
Why it matters
A maintainer's account reaches every repo they can write to, including company repos. A stolen publishing token lets attackers poison packages and images used by thousands of projects.
What to do
- Look for
.github/workflows/security-audit.yml(or unknown workflows) across all branches and forks, and review workflow commits since August 31. - If found, assume compromise: revoke the GitHub credential used and rotate every secret in the repo and in git history.
- Review cloud logs for key use after the infection date.
- Purge secrets from history; use secret managers and OIDC instead of long-lived keys.
- Harden accounts: passkeys/security keys, review personal tokens, and branch protection requiring review for changes under
.github/workflows. - Restrict egress from runners to approved destinations.
Sources
- The Hacker News: https://thehackernews.com/2026/10/credential-stealing-github-actions.html
- Socket: https://socket.dev/blog/ghostaction-cloud-credentials
- GitGuardian: https://blog.gitguardian.com/ghostaction-github-actions-supply-chain-attack-returns/
- The Exploit Bulletin: https://exploitbulletin.com/bulletin/2026-10-10/supply-chain-github-actions-ghostaction-2026-10-10
Want to audit your CI/CD pipeline and secrets? KGA IT offers a free consultation: kga-it.com.