GhostAction Hijacked 1,900 GitHub Accounts to Steal Secrets

In short: On October 8–9, 2026, a campaign dubbed GhostAction compromised about 1,900 GitHub accounts and planted malicious GitHub Actions workflows across more than 30,000 repositories. The files were disguised as routine security checks — named "security-audit.yml" or "github_actions_security.yml" — and secretly exfiltrated every secret they could find: CI/CD tokens, cloud provider keys, and AI service keys, sent to a hardcoded IP address. GitHub blocked the malicious workflows from running on October 9, but developers whose accounts or dependencies were affected still need to rotate any compromised keys. If you're a developer storing passwords and tokens in a browser or password manager, our guide on password manager security covers how to avoid losing them in a breach like this.

What happened

According to researchers at StepSecurity and GitGuardian, attackers gained write access to repositories using stolen Personal Access Tokens (PATs) — access tokens previously leaked through infostealer malware or credential dumps. The exact source of the leaked PATs hasn't been confirmed. Once attackers had access to a maintainer's account, they pushed a new GitHub Actions workflow file under a plausible "security check" name, betting that developers wouldn't scrutinize a file that looked like part of their standard CI/CD process.

How the malicious workflow operated

The disguised process collected two categories of data: pre-stored GitHub Actions secrets (encrypted environment variables with passwords and tokens that developers deliberately keep in a repository's secure vault) and any cloud, AI, and SaaS credentials findable anywhere in the project's working tree and its entire git commit history — including keys accidentally committed and later removed from the current codebase but still present in old commits. Everything found was sent via a plain HTTP request to a hardcoded attacker-controlled IP address. Activity peaked on October 8 and 9, 2026, during which attackers attempted to extract 3,174 secrets from compromised repositories.

Why this is more than "just another GitHub hack"

GhostAction is a textbook software supply chain attack: the target wasn't the developers themselves but the infrastructure their code flows through to reach everyone else. Stolen CI/CD tokens grant access to build and publishing pipelines — which, in theory, could let attackers slip malicious code into a package or container image that thousands of other developers and their users later download. A separate target was AI service keys: access to a major AI provider's API is worth money on its own, letting an attacker at minimum abuse someone else's paid quota, and at worst reach internal company data and prompts. The same principle — mass credential theft through infected software rather than breaking into the service directly — is covered in our piece on how infostealers steal passwords.

What GitHub did, and what's still on developers

GitHub blocked the malicious workflows from running on October 9, 2026 — two subsequent waves of the attack were unable to extract any secrets. But blocking the mechanism doesn't undo the compromise of data already stolen: if your account or a dependency you use was among those affected, the old secrets remain valid keys in an attacker's hands until manually revoked.

• Check your repositories' GitHub Actions workflows for files with suspiciously generic names like "security-audit.yml" or "github_actions_security.yml" that you didn't add yourself.
• Rotate every GitHub Actions secret, cloud key, and AI key if there's any suspicion your account or a dependency was compromised.
• Use short-lived, fine-grained PATs with limited scope instead of classic PATs that never expire.
• Require a second reviewer for any change to .github/workflows/ files — a new workflow pushed from a compromised maintainer account shouldn't land on main unreviewed.
• If you administer CI/CD infrastructure remotely over unstable or public networks, a VPN on the device reduces the risk of your management session being intercepted — see LiMP VPN's features for Windows, Android, and Chrome.

Sources

• Habr / Selectel — "Hackers hijacked 1,900 GitHub accounts and attacked 30,000 repositories"
• The Hacker News — "GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories"
• StepSecurity — "GhostAction Campaign: Over 3,000 Secrets Stolen Through Malicious GitHub Workflows"