A sweeping malicious campaign dubbed GhostAction has infected approximately 790 GitHub repositories with harmful workflows that harvest cloud credentials, software-publishing tokens, and AI service keys. The count comes from OpenSourceMalware’s validation through October 9, 2026, and reflects publicly visible repositories—though not all may have suffered confirmed misuse.
How the Threat Operates
GhostAction takes advantage of trusted developer accounts. Once an attacker gains write access to a maintainer’s repo, they insert a workflow that triggers on code pushes or manual invocation. This workflow searches the repo for secrets—current GitHub Actions secrets, AWS keys, and tokens for services like GitHub, Google, Slack, SendGrid, OpenAI, Anthropic, and OpenRouter. Crucially, it also scans commit history by setting fetch-depth: 0 to fetch entire history, since removed secrets can linger in old commits.
The extracted data, which can include context around credentials, is then exfiltrated to attacker-controlled servers over plain HTTP. Because these actions may resemble routine build activity, detecting the malicious behavior depends heavily on reviewing workflow changes and monitoring outbound network traffic.
Scale and Earlier Incident Patterns
Between August 31 and September 30, GitGuardian flagged 772 affected repositories. By October 9, OpenSourceMalware had identified 790 repositories impacted—some of which may no longer be publicly visible. A related surge on October 8 showed 346 repos tied to just two compromised accounts. Affected repos include active, forked, and long-dormant projects, suggesting attackers swept broadly across accounts to find repositories they could modify.
No malicious PyPI or crates.io releases had been linked to the latest wave as of October 9, but earlier incidents in the GhostAction campaign had already shown similar supply chain behaviors.
Aftermath & Defense Measures
Removing the malicious workflow doesn’t fix everything. Once a workflow runs successfully, stolen tokens, cloud keys, or publishing credentials may already be compromised. To respond safely, teams should keep workflow files, logs, and commits for audit; revoke credentials used by the attacker; rotate exposed secrets; and review package releases and cloud activity from the period of exposure.
Best practices from GitHub include enforcing least-privilege access for workflows, reviewing workflow code changes, limiting runner network access, and requiring approvals for sensitive workflow modifications. OpenSourceMalware also flagged suspicious infrastructure, including the domain my-github.com and related IPs and endpoints. Watchlisted items like similarly named GitLab domains remain unconfirmed links.
Indicators of compromise include specific SHA-256 hashes, DNS patterns, workflow file paths (.github/workflows/security-check.yml, etc.), IP addresses tied to data collection infrastructure, and payload markers like AKIA_CTX_START, curl -s -m 20 -X POST, and others.
GhostAction represents a growing threat in software supply chain and developer tool abuse. By piggybacking on legitimate CI/CD workflows that have access to powerful secrets, this campaign highlights how much damage can occur when attacker access goes unnoticed. Monitoring repo changes, logs, and unexpected credential use is now a must.
What this means: Every organization using GitHub—or any CI/CD platform—should treat secrets and workflows with suspicion. Gains in automation also open angles for abuse. What to watch: strange workflow commits in dormant repos, unexpected network calls from build runners, and use of least privilege policies. In the long run, better tooling for detecting workflow tampering, combined with strong credential hygiene, will become non-negotiable.
