GhostAction Campaign Escalates, Compromising 1,900 GitHub Accounts and Targeting 30,000+ Repositories

The GhostAction credential-theft campaign has intensified dramatically, impacting over 30,000 GitHub repositories across approximately 3,000 users and organizations. This surge, primarily observed on October 8th and 9th, 2026, resulted from the compromise of around 1,900 GitHub accounts. Threat actors are injecting malicious GitHub Actions workflows, often disguised as "security-audit.yml" or "github_actions_security.yml," into targeted repositories. The primary objective is the large-scale exfiltration of sensitive data, including CI/CD secrets, cloud credentials, package registry tokens (npm, PyPI, DockerHub), and API keys for AI providers like Anthropic, OpenAI, and OpenRouter. This escalation matters profoundly to any organization leveraging GitHub Actions for their CI/CD pipelines. The compromise of developer accounts and subsequent injection of malicious workflows directly undermines the integrity of the software supply chain. Developers and DevOps teams are at immediate risk of having their critical credentials stolen, leading to potential unauthorized access to cloud environments, private code, and production systems. The campaign's focus on AI API keys also signals a growing threat vector targeting the burgeoning AI development landscape. The GhostAction campaign is not new; it was first identified in September 2025 and has seen previous waves of activity. This sustained effort underscores a broader trend in cybersecurity where attackers increasingly target CI/CD pipelines as a high-leverage point for compromise. The use of stolen Personal Access Tokens (PATs) or credentials obtained from infostealer logs to gain write access to repositories is a common tactic in such supply chain attacks. GitHub itself has been actively working on hardening GitHub Actions, with a 2026 roadmap focusing on deterministic dependencies, stronger policies, scoped credentials, and improved observability to counter such threats. In practice, practitioners must take immediate and decisive action. First, thoroughly audit all GitHub repositories for the presence of suspicious workflow files, particularly those named "security-audit.yml" or "github_actions_security.yml," especially for any commits since August 31, 2026. If found, assume compromise and immediately revoke any GitHub credentials associated with the affected accounts, rotate all secrets (AWS keys, cloud credentials, AI API keys, package tokens) that could have been exposed, and delete the malicious workflows from all branches. Furthermore, organizations should enforce stricter policies around PAT usage, implement multi-factor authentication for all GitHub accounts, and regularly review GitHub Action permissions to adhere to the principle of least privilege. Continuous monitoring for unusual GitHub Actions activity and integrating supply chain security tools that scan for malicious workflow injections are no longer optional but essential safeguards.