The credential-stealing campaign tracked as GhostAction escalated sharply in October 2026, reaching more than 30,000 repositories tied to 3,000 users and organizations, according to GitGuardian.
Researchers Gaetan Ferry and Guillaume Valadon said the surge on October 8 and 9 followed the compromise of roughly 1,900 GitHub accounts and involved attempts to pull 3,174 secrets from public repositories' CI pipelines.
GhostAction, a supply chain campaign against GitHub developer infrastructure, first surfaced in September 2025. Attackers use stolen Personal Access Tokens or credentials lifted from infostealer logs to gain write access, then push malicious workflow files disguised as security tooling under names like "security-audit.yml" or "github_actions_security.yml." The objective is bulk theft of CI/CD secrets, cloud credentials, package registry tokens for npm, PyPI and DockerHub, and AI provider API keys.
A fresh wave has run since August 31, 2026, with the malicious workflow pushed to hundreds of repositories. GitGuardian described this wave as more experimental and manual than earlier ones, with the payload evolving over time and an initial version adding a git history secret-scanning feature. That scanner uses detection rules covering AWS key IDs, GitHub and GitLab tokens, AI-related secrets and cloud API keys. A later variant captures roughly two lines of context around each AWS key ID to pair it with its matching secret access key, and a third supports retrieving secret context during the history scan.
The payload rolled out in phases: first to 160 previously seen victims, then 20 minutes later to 28,000 new repositories between October 8 and 9. Further waves using the same payload appeared October 10 and 12, but GitHub began blocking the malicious workflow from running on October 9, so those waves extracted no secrets. Some victims in the new burst had already been hit in the September 2025 and August 2026 waves, suggesting the attackers are counting on secrets that were never rotated.
Source: The Hackers News