Actor Profile

GhostAction is a large-scale supply chain attack campaign first identified in September 2025, focused on compromising GitHub maintainer accounts to inject malicious GitHub Actions workflows. The campaign operators obtain GitHub credentials—likely personal access tokens (PATs)—from infostealer logs or credential dumps, then leverage compromised high-profile maintainer accounts to push malicious workflows at scale. As of October 2026, over 500 GitHub accounts have been used to commit malicious workflows to tens of thousands of repositories. The attackers' motivation appears to be mass credential harvesting targeting CI/CD secrets, cloud provider keys, AI service tokens, and SaaS credentials. In at least one instance, the threat actors also deployed XMRig cryptocurrency miners, suggesting financial motivation.

TTPs (Tactics, Techniques, Procedures)

The campaign employs the following TTPs: Initial Access via compromised credentials (T1078.004 - Valid Accounts: Cloud Accounts), likely sourced from infostealer malware or credential dumps. Reconnaissance (T1580 - Cloud Infrastructure Discovery) by scanning repository workflow files for secrets. Persistence through malicious GitHub Actions workflow injection (T1554 - Compromise Client Software Binary) disguised as security audits ("security-audit.yml" or "github_actions_security.yml"). Credential Access (T1552.001 - Unsecured Credentials: Credentials In Files) by scanning working trees and entire git history for 13 credential patterns including AWS keys, AI service keys, and SaaS tokens. Collection (T1213 - Data from Information Repositories) of named GitHub Actions secrets, CI/CD credentials, and cloud provider keys. Exfiltration (T1041 - Exfiltration Over C2 Channel) via curl to hard-coded IP address 193.32.204[.]199 over unencrypted HTTP. Resource Hijacking (T1496) through XMRig cryptocurrency miner deployment in at least one compromised Docker image.

Targets & Patterns

The campaign targets the software development ecosystem, specifically open-source maintainers and organizations using GitHub for CI/CD workflows. High-profile victims include Takashi Kitao (author of the 18,400-star pyxel game engine) and Henry Wu (original author of Uber's athenadriver). The attackers prioritize accounts with broad repository access to maximize propagation—Henry Wu's compromised account pushed malicious workflows to 318 repositories in just 16 minutes. Between August 31 and September 30, 2026, the campaign affected 772 public repositories across 373 GitHub users and organizations. The threat actors specifically target repositories containing high-value credentials: PyPI, npm, and DockerHub tokens; AWS access keys; Azure credentials; AI service keys (Anthropic, OpenAI, OpenRouter); database credentials; SSH private keys; and bot tokens for Telegram, Slack, and Discord. Private forks and downstream mirrors face elevated risk as they more commonly contain committed credentials. The campaign's scale—tens of thousands of repositories—indicates automated, opportunistic targeting rather than selective victim profiling.

Historical Context

GhostAction first emerged in September 2025, initially impacting 817 repositories across 327 GitHub users and resulting in the exfiltration of 3,325 secrets including PyPI, npm, and DockerHub tokens. The campaign has demonstrated sustained operational tempo and evolution: between August 31 and September 30, 2026, GitGuardian observed 772 public repositories compromised across 373 users/organizations, with 2,577 secrets targeted. The October 2026 wave represents significant escalation, with Socket identifying over 500 compromised GitHub accounts committing malicious workflows to tens of thousands of repositories since October 7, 2026. The campaign maintains consistent TTPs across iterations—using the same workflow names ("security-audit.yml", "github_actions_security.yml"), identical exfiltration infrastructure (193.32.204[.]199), and the same 13 credential patterns. The August 30, 2026 compromise of the "kuafuai/DevOpsGPT" repository marked tactical expansion into cryptocurrency mining via XMRig embedded in Docker images. As of October 9, 2026, no malicious package releases have been published using stolen publishing credentials, suggesting the operators prioritize credential collection over immediate supply chain poisoning.

Defensive Recommendations

  • Audit all repositories for suspicious workflow files named 'security-audit.yml' or 'github_actions_security.yml' added since August 31, 2026; treat presence as confirmed compromise requiring immediate credential rotation
  • Monitor GitHub Actions workflow execution for T1041 exfiltration indicators: outbound curl/wget commands to non-standard IP addresses, especially 193.32.204[.]199, and HTTP (non-HTTPS) data transfers
  • Implement GitHub Actions workflow approval requirements for first-time workflows and restrict workflow_dispatch triggers to prevent T1554 malicious workflow injection
  • Scan git history across all branches for T1552.001 credential exposure using tools like GitGuardian or TruffleHog, focusing on AWS keys, AI service tokens, and SaaS credentials; rotate any discovered secrets
  • Enforce short-lived, scope-limited personal access tokens (PATs) with IP allowlisting and enable GitHub Advanced Security secret scanning to detect T1078.004 credential compromise; inspect downstream forks and mirrors for inherited malicious workflows