/
← Voltar ao feed
high technology software development

GhostAction campaign injects credential-stealing GitHub Actions workflows into 790 repositories via hijacked maintainer accounts

1 fonte(s) · 1 atualização(ões) · publicado 20/10/2026 04:00 · coletado há 1 dia

GhostAction has returned with an expanded credential-theft operation. By October 9, 2026, attackers had injected malicious GitHub Actions workflows into 790 repositories, according to OpenSourceMalware's validated total. The campaign was first documented by GitGuardian in 2025 (817 repositories, 3,325 stolen secrets). It relies on compromised maintainer accounts to push security-themed workflows, sometimes directly to the default branch without a pull request or review. Socket and StepSecurity observed successful workflow executions, but Socket reported no malicious PyPI or crates.io releases from the October wave at publication time. That does not mean the exposed credentials are safe.

Detalhes técnicos

  • Attackers enumerate repositories a compromised account can write to and push a workflow that triggers on push or manual execution.
  • The October variant, security-audit.yml, checks out the full history (fetch-depth: 0). It searches the working tree and reachable Git history for credential patterns, including AWS key identifiers with surrounding context. This can expose long-deleted secrets. Targeted credentials include AWS, GitHub and GitLab tokens and AI-service keys.
  • Data is exfiltrated over unencrypted HTTP to 193.32.204[.]199, including the /?c=monami endpoint.
  • Socket and StepSecurity documented two automated bursts on October 8: 27 repositories tied to the compromised kitao account, and 318 tied to henrywoo (279 forks, including Uber's uber/athenadriver). In that case the workflow was pushed directly to master under the maintainer's identity, and an execution reached the collector.
  • The inclusion of dormant projects and many forks suggests automated enumeration of writable repositories rather than selective targeting.
  • OpenSourceMalware flagged two recently registered domains. my-github[.]com resolves to the collector IP. my-gitlab[.]com points to separate infrastructure, and its link to GhostAction is unproven.
  • Payload markers: AKIA_CTX_START, ?c=monami, and the filenames security-audit.yml and github_actions_security.yml.

Remediação

  • Search repositories, workflow files and commit history for the IP, filenames and payload markers above. Review workflow runs and audit logs for unexpected commits, rapid multi-repository pushes, manual dispatches and runner egress to the collector.
  • If a malicious workflow or run is found, remove it across all branches and forks, revoke the compromised account's tokens and sessions, and rotate every exposed secret, including any that appeared in repository history.
  • Review package releases, cloud activity and related services for unauthorized use.
  • Require review for changes under .github/workflows/, restrict runner egress to approved destinations, and scope secrets to the jobs that need them.

Linha do tempo

  1. gbhackers.com ↗ · pub. 20/10/2026 04:00 · coletado 20/10 05:00 primeiro registro

    GhostAction campaign injects credential-stealing GitHub Actions workflows into 790 repositories via hijacked maintainer accounts

    ler a análise desta fonte

    GhostAction has returned with an expanded credential-theft operation. By October 9, 2026, attackers had injected malicious GitHub Actions workflows into 790 repositories, according to OpenSourceMalware's validated total. The campaign was first documented by GitGuardian in 2025 (817 repositories, 3,325 stolen secrets). It relies on compromised maintainer accounts to push security-themed workflows, sometimes directly to the default branch without a pull request or review. Socket and StepSecurity observed successful workflow executions, but Socket reported no malicious PyPI or crates.io releases from the October wave at publication time. That does not mean the exposed credentials are safe.

    Technical Details

    • Attackers enumerate repositories a compromised account can write to and push a workflow that triggers on push or manual execution.
    • The October variant, security-audit.yml, checks out the full history (fetch-depth: 0). It searches the working tree and reachable Git history for credential patterns, including AWS key identifiers with surrounding context. This can expose long-deleted secrets. Targeted credentials include AWS, GitHub and GitLab tokens and AI-service keys.
    • Data is exfiltrated over unencrypted HTTP to 193.32.204[.]199, including the /?c=monami endpoint.
    • Socket and StepSecurity documented two automated bursts on October 8: 27 repositories tied to the compromised kitao account, and 318 tied to henrywoo (279 forks, including Uber's uber/athenadriver). In that case the workflow was pushed directly to master under the maintainer's identity, and an execution reached the collector.
    • The inclusion of dormant projects and many forks suggests automated enumeration of writable repositories rather than selective targeting.
    • OpenSourceMalware flagged two recently registered domains. my-github[.]com resolves to the collector IP. my-gitlab[.]com points to separate infrastructure, and its link to GhostAction is unproven.
    • Payload markers: AKIA_CTX_START, ?c=monami, and the filenames security-audit.yml and github_actions_security.yml.

    Remediation

    • Search repositories, workflow files and commit history for the IP, filenames and payload markers above. Review workflow runs and audit logs for unexpected commits, rapid multi-repository pushes, manual dispatches and runner egress to the collector.
    • If a malicious workflow or run is found, remove it across all branches and forks, revoke the compromised account's tokens and sessions, and rotate every exposed secret, including any that appeared in repository history.
    • Review package releases, cloud activity and related services for unauthorized use.
    • Require review for changes under .github/workflows/, restrict runner egress to approved destinations, and scope secrets to the jobs that need them.