GhostAction variant plants credential-stealing workflow in 346 GitHub repos, including uber/athenadriver

Linha do tempo

1. infosecurity-magazine.com ↗ · pub. 09/11/2026 11:30 · coletado 09/11 12:00 primeiro registro

   GhostAction variant plants credential-stealing workflow in 346 GitHub repos, including uber/athenadriver

   ler a análise desta fonte ocultar

   Socket's research team reports that a GhostAction variant committed a malicious workflow named security-audit.yml into 346 repositories on October 8, 2026, using two compromised maintainer accounts, henrywoo and kitao (socket.dev). The file presents itself as a security tool but performs no security function: it reads GitHub Actions secrets and, as the new element of this wave, scans working trees and full git history for cloud and AI service credentials before posting them over plain HTTP to 193.32.204[.]199 (socket.dev). The affected set includes the Uber-owned uber/athenadriver and the widely starred kitao/pyxel, and Socket observed the workflow running successfully in affected repositories. As of October 9, 2026 the malicious file was still on default branches, and Socket had seen no malicious releases on PyPI or crates.io, which does not rule out misuse of the stolen credentials. Urgency is high because the secrets may already be in attacker hands, although the operator needed maintainer write access that Socket did not see how they obtained.

   Technical Details

   • Two commits with the messages 'Add security audit workflow' and 'Update security audit workflow' added the file to every repository the two accounts could write to (socket.dev).
   • Socket counted 318 henrywoo-namespace repositories (39 sources and 279 forks), 27 kitao repositories and uber/athenadriver; dormant repositories were included, which points to automated enumeration (socket.dev).
   • The payload first lists the Actions secret names present in each repository and then embeds them in the file, so the secret list varies by repository (socket.dev).
   • The added sweep uses regular expressions over the working tree and the full history (git log -p --all), so credentials deleted from the current branch can still be collected (socket.dev).
   • The workflow triggers on push with no branch or path filter, so it runs on the next push to the default branch (socket.dev).
   • Socket noted that the henrywoo forks carry the file too, and that subsequent pushes there can trigger harvesting if Actions is enabled (socket.dev).

   Remediation

   • Rotate every secret named in the injected file, and revoke rather than rotate the GitHub personal access token (socket.dev).
   • Review PyPI and crates.io release history for unexpected versions published during and after the exposure window (socket.dev).
   • Treat any completed run of the injected workflow as a successful exfiltration of the named secrets (socket.dev).
   • Scan the full git history, rotate every credential found there, and review CloudTrail for AWS keys that appear in history (socket.dev).
   • Remove the workflow file and revert the commit in every affected repository, including organization-owned ones, and treat the maintainer accounts as fully compromised: revoke sessions, tokens and SSH keys and enforce phishing-resistant MFA (socket.dev).

   Conflicting Reports

   • The article describes the compromise as affecting 'tens of thousands' of repositories; Socket's analysis counts 346 repositories where the file was observed, which is the more specific and authoritative figure (socket.dev).
   • The article names 'kitao/pixel'; the repository Socket names is kitao/pyxel (socket.dev).
   • The article says the affected kitao project is typically distributed through PyPI and crates.io; Socket states that the kitao/pyxel repository distributes through both registries (socket.dev).