The GhostAction credential-theft campaign has intensified, targeting more than 30,000 repositories associated with around 3,000 users and organizations on GitHub.
According to cybersecurity firm GitGuardian, the latest surge occurred on October 8 and 9, 2026, when attackers attempted to steal thousands of secrets from public repositories through malicious GitHub Actions workflows.
The campaign involved compromising the GitHub accounts of approximately 1,900 users and attempting to extract 3,174 secrets from continuous integration (CI) environments. Security researchers Gaetan Ferry and Guillaume Valadon said the activity represents a significant escalation in the ongoing attacks against developer infrastructure.
First discovered in September 2025, GhostAction is a supply chain attack campaign that targets GitHub repositories by hijacking legitimate developer accounts and injecting malicious automation workflows. Attackers obtain write access using stolen Personal Access Tokens (PATs) or credentials collected from infostealer logs and leaked data dumps.
Once an account is compromised, attackers introduce malicious workflow files disguised as legitimate security tools. These files use names such as security-audit.yml and github_actions_security.yml to make them appear to be routine security checks, increasing the chances of remaining unnoticed.
The primary objective is to steal sensitive information stored in development environments, including CI/CD secrets, cloud credentials, package registry tokens for platforms such as npm, PyPI and DockerHub, and API keys belonging to artificial intelligence providers.
GitGuardian reported that another wave of GhostAction activity had been underway since August 31, 2026, with malicious workflows appearing in hundreds of repositories. Unlike earlier attacks, this latest campaign appears to involve more experimental and manually modified payloads that have evolved over time.
The initial version of the new payload introduced a feature that scans Git history for exposed secrets. Its detection patterns cover AWS key IDs, GitHub and GitLab tokens, AI-related credentials and cloud API keys. This approach allows attackers to search historical changes for sensitive information that may no longer be present in the current version of a repository.
A second version expanded the functionality by collecting approximately two lines of surrounding context for each detected AWS key ID. This information could help attackers identify corresponding secret access keys. A third version added further support for retrieving contextual information during Git history scans.
According to GitGuardian, the October attack was deployed in several phases. The attackers first targeted 160 previously identified victims before launching a much larger wave against 28,000 new repositories approximately 20 minutes later. Additional waves using the same payload were observed on October 10 and 12.
However, GitHub began preventing the malicious workflows from executing on October 9. As a result, the two subsequent waves were unable to extract secrets through those workflows, according to GitGuardian.
Researchers also found that some victims in the latest wave had already been compromised during the September 2025 and August 2026 campaigns. This suggests that attackers may be returning to previously breached accounts in the hope that exposed credentials have not been rotated or revoked.
The repeated targeting of previously compromised repositories highlights the importance of treating exposed credentials as compromised even after malicious activity has been stopped. Developers and organizations should review GitHub Actions workflows for suspicious changes, audit repository access and rotate potentially exposed tokens, cloud credentials and API keys. Removing a malicious workflow alone may not be enough if stolen secrets remain valid.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
GhostAction Attack Targets 30,000 GitHub Repositories in New Credential Theft Wave
