The credential-theft campaign known as GhostAction has ramped up, targeting more than 30,000 repositories across 3,000 users and organizations.

The spike, according to GitGuardian, was observed on October 8 and 9, 2026.

"This resulted from compromising the GitHub accounts of about 1,900 users. It attempted to extract 3,174 secrets from public repositories' CI," security researchers Gaetan Ferry and Guillaume Valadon said.

GhostAction is the moniker for a supply chain attack campaign targeting developer infrastructure on GitHub. Originally discovered in September 2025, it involves threat actors compromising legitimate developer accounts to inject malicious GitHub Actions automation workflows into software repositories.

Attackers have been found to gain write access to repositories using stolen Personal Access Tokens (PATs) or credentials harvested from infostealer logs and dumps. Using the hijacked maintainer account, they push a malicious workflow file disguised under deceptive names such as Security Audit ("security-audit.yml") or GitHub Actions Security ("github_actions_security.yml").

The end goal of the activity is the large-scale theft of continuous integration and continuous deployment (CI/CD) secrets, cloud credentials, package registry tokens (like npm, PyPI, and DockerHub), and artificial intelligence (AI) provider API keys.

A new wave of GhostAction has been observed since August 31, 2026, with the malicious workflow pushed to hundreds of repositories.

"This new wave seems more experimental and manual than previous ones, with the payload evolving over time," GitGuardian said. "Compared with the original GhostAction payload, the first version of this new payload added a git history secret-scanning feature."

As previously outlined by Socket and StepSecurity, the history-scanning feature features secret-detection regular expressions covering AWS key IDs, GitHub and GitLab tokens, AI-related secrets, and cloud API keys.

Source link