Hackers accessed roughly 1,900 GitHub accounts, then used them to slip credential-stealing workflows into more than 30,000 repositories. The malicious GitHub Actions jobs targeted CI/CD secrets, cloud access keys, and AI provider API keys. GitGuardian tracked the GhostAction campaign as it intensified, with the biggest push on October 8 and 9, when the attackers reached repositories belonging to about 3,000 users and organizations and tried to extract 3,174 secrets.

The tj-actions/changed-files compromise poisoned a shared Action used by thousands of repositories. GhostAction took a different route, using stolen developer credentials to modify workflows directly, with no vulnerability in GitHub Actions itself.

It’s unclear how the attackers obtained those credentials, but StepSecurity’s October 9 analysis points to personal access tokens pulled from credential dumps as the likely source, though the initial compromise hasn’t been confirmed.

With access to the repositories, the attackers could then add disguised workflows of standard security jobs, while using names like security-audit.yml or github_actions_security.yml. Since the files referenced secrets already used by legitimate builds, it gave the malicious jobs the chance to collect those credentials when they ran and send them to an attacker-controlled server.

The October variant went beyond the secrets explicitly referenced by workflows, using actions/checkout@v4 with fetch-depth: 0 to scan the working tree and Git history for AWS keys, GitHub and GitLab PATs, Google and Firebase keys, and API tokens from Anthropic, OpenAI and OpenRouter. Later versions captured surrounding lines to pair AWS key IDs with their corresponding secret access keys.

199 , including keys removed from the current codebase but still present in Git history.

Source link