A rising campaign known as GhostAction has targeted roughly 1,900 GitHub accounts and more than 30,000 repositories in a large-scale supply chain attack, according to recent security findings. The surge, first observed between October 8 and 9, 2026, marked a new escalation in an ongoing threat to developer infrastructure. Security analysts believe the attackers gained access via compromised maintainer accounts and have been focusing on stealing sensitive credentials from repositories and CI/CD pipelines.
What is GhostAction?
GhostAction is a campaign that began in September 2025. It involves hijacking developer accounts on GitHub—often using stolen Personal Access Tokens or credentials harvested from leaks—and injecting malicious GitHub Actions workflows into both public and forked repositories. These workflows are designed to steal secrets like cloud credentials, package registry tokens, and API keys for AI services. The workflows are typically disguised using innocuous filenames such as security-audit.yml or github_actions_security.yml, to look like routine security tools rather than attacks.
The October 2026 Resurgence
In a renewed burst of activity starting around October 8, two widely used maintainer accounts were compromised to inject the malicious workflows into hundreds of repositories. One account pushed the workflow to 27 repositories over a short window; the second, many hours later, propagated it to 318 repositories across 16 minutes—nearly every repository that those accounts could write to. These efforts are estimated to have ultimately impacted as many as 30,000 repositories since October 7. According to GitGuardian, between August 31 and September 30, 2026, 772 public repositories belonging to 373 users were affected, with over 2,500 secrets targeted. Workflow modifications weren’t just fresh insertions—many workflows injected in earlier waves were backdoored to point to new attack endpoints, allowing sustained access via existing persistent workflows.
Techniques & Targets
The workflows not only target GitHub Actions secrets available during CI/CD runs but also scan full git history—checking every branch and commit—for credential patterns including AWS keys, GitHub/GitLab tokens, and various AI API secrets. The exfiltration endpoint identified is 193.32.204.199, used over HTTP. Some variants of the payload included additional functionality: one version added regular expression-based secret detection, another pulled in context around AWS key hits to match secret access keys, and yet another captured context during full git history scans. From October 9 onward, GitHub intervened to prevent malicious workflows from running, though the code persistently exists in many repositories.
Why This Matters
GhostAction has repeatedly resurfaced since its initial discovery, suggesting it was never fully neutralized. Compromised accounts from earlier waves (September 2025, August 2026) appear to remain useful to attackers—many secrets stolen during those waves have not been rotated, allowing repeated breach opportunities. Since injected workflows often persist in forks and default branches long after alerts are raised, exposing credential leakage even if immediate workflows are replaced or removed.
Recommended Defenses
- Audit every repository and fork for suspicious workflows, especially files named
security-audit.ymlorgithub_actions_security.yml, and check workflow changes since August 31, 2026. - Rotate all credentials and secrets exposed in both current workflows and repository history.
- Restrict permissions on workflow files—only verified maintainers should be able to write or modify
.github/workflows/. - Monitor outbound HTTP traffic from CI/CD workflows for signs of exfiltration to known malicious endpoints.
The extent of the GhostAction strain underlines a serious hygiene lapse in open-source software maintenance: stolen tokens are often left unrotated, workflows go unchecked, and automated policies around repo-write permissions remain underutilized. Dev teams and GitHub maintainers must treat these infected workflows not as past incidents but as persistent vulnerabilities in need of active remediation.
Analysis: This resurgence of GhostAction shows the persistence—and evolution—of supply chain attacks on developer infrastructure. It’s not just about new injections: the threat actors are leveraging existing footholds, modifying old workflows, and escalating privileges subtly. What to watch for now: how platform providers like GitHub respond with policy or tooling changes, whether defenders successfully enforce rotation and branch protection at scale, and if clean-up efforts reduce the long tail of exposed secrets. The good news is that detection patterns are clearer; the bad news is many defenses—like token hygiene—are longstanding organizational weak spots.
