GhostAction Campaign Escalates, Targeting GitHub Repositories for CI/CD and AI Secrets

The GhostAction credential-theft campaign has seen a dramatic increase in activity, impacting over 30,000 repositories across 3,000 users and organizations on GitHub. The surge, primarily observed on October 8 and 9, 2026, stemmed from the compromise of approximately 1,900 GitHub accounts. Attackers leveraged these compromised accounts to attempt the extraction of over 3,174 secrets from public repositories' CI/CD workflows. This escalation matters significantly to practitioners because it represents a sophisticated supply chain attack. Threat actors are not merely targeting end-users; they are going after the very infrastructure of software development. By hijacking developer accounts and injecting malicious GitHub Actions, they gain a foothold to steal critical assets such as CI/CD secrets, cloud credentials, package registry tokens, and even AI provider API keys. This directly impacts the integrity and security of software being developed and deployed, potentially leading to widespread downstream compromises. The fact that a subset of victims from earlier waves (September 2025 and August 2026) were re-compromised in this latest surge underscores a dangerous reliance on unrotated secrets. This incident fits into a broader, well-established trend of attackers increasingly targeting developer platforms and the software supply chain. Recent reports have highlighted how AI agents can accelerate the distribution of malicious dependencies and how weaknesses in package managers like npm can be exploited to hijack legitimate software packages. The focus on stealing AI provider API keys also reflects the growing value of AI assets to malicious actors, a trend that has been observed in the rise of AI-related discussions on underground forums. The increasing sophistication of autonomous hacking tools, such as MONST3R-AI, which can run on stolen AI provider keys, further emphasizes the critical need to secure these credentials. In practice, developers and organizations must immediately review and strengthen their GitHub account security, implementing multi-factor authentication and regularly auditing access permissions. A critical step is the frequent rotation of all secrets, especially those used in CI/CD pipelines, to mitigate the impact of any past or future compromises. Furthermore, vigilant monitoring of GitHub Actions for any unauthorized or suspicious workflow injections is paramount. Organizations should also consider implementing stricter policies around what types of data, particularly personal information or sensitive credentials, are allowed in GitHub repositories to prevent accidental exposure. The incident serves as a stark reminder that even seemingly minor compromises of developer accounts can have far-reaching consequences across the entire software supply chain.