GhostAction variant hits GitHub repos incl. uber/athenadriver and kitao/pyxel, stealing CI/CD, cloud and AI credentials
Matéria consolidada. Reúne 4 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 3 fontes trouxeram em 10/11/2026 00:08; os links antigos trazem para cá.
Fontes: infosecurity-magazine.com ↗ gbhackers.com ↗ darkreading.com ↗
The GhostAction supply chain campaign targeting GitHub is still active. In late October 2026, Dark Reading (darkreading.com) described it as waning on the platform but shifting toward developer endpoints and cloud access. By 9 November 2026, GBHackers (gbhackers.com) reported a new wave that pushed a credential-stealing GitHub Actions workflow into tens of thousands of repositories, hunting for cloud and AI keys in source code and git history as well as CI/CD secrets. Also on 9 November 2026, Infosecurity Magazine (infosecurity-magazine.com), relaying research by Socket (socket.dev), detailed a variant that committed a malicious workflow named security-audit.yml into 346 repositories on 8 October 2026. The commits came from two compromised maintainer accounts, henrywoo and kitao, and the affected set includes the Uber-owned uber/athenadriver and the widely starred kitao/pyxel. The workflow reads GitHub Actions secrets, scans the working tree and full git history for cloud and AI credentials, and sends them over plain HTTP to 193.32.204[.]199 (socket.dev). Socket saw the workflow run successfully in affected repositories and the file still on default branches as of 9 October 2026, so the secrets may already be in attacker hands. No threat actor is named and no CVEs are cited, and Socket did not see how the operator obtained maintainer write access.
Detalhes técnicos
- Campaign type: supply chain attack abusing GitHub-hosted development workflows (darkreading.com).
- Wave reported by GBHackers: a malicious GitHub Actions workflow injected into tens of thousands of repositories to steal credentials; targeted secrets are CI/CD secrets plus cloud and AI keys in source code and git history (gbhackers.com).
- Reported evolution: increasing focus on developer endpoints and cloud access (darkreading.com).
- Socket variant: the file security-audit.yml presents itself as a security tool but performs no security function. It reads GitHub Actions secrets and, as the new element of this wave, scans working trees and full git history for cloud and AI service credentials, then posts them over plain HTTP to 193.32.204[.]199 (socket.dev).
- Delivery: two commits with the messages 'Add security audit workflow' and 'Update security audit workflow' added the file to every repository the two compromised accounts could write to, on 8 October 2026 (socket.dev).
- Scope counted by Socket: 318 henrywoo-namespace repositories (39 sources and 279 forks), 27 kitao repositories and uber/athenadriver. Dormant repositories were included, which points to automated enumeration (socket.dev).
- The payload first lists the Actions secret names present in each repository and embeds them in the file, so the secret list varies by repository (socket.dev).
- The added sweep uses regular expressions over the working tree and the full history (git log -p --all), so credentials deleted from the current branch can still be collected (socket.dev).
- The workflow triggers on push with no branch or path filter, so it runs on the next push to the default branch. The henrywoo forks carry the file too, and later pushes there can trigger harvesting if Actions is enabled (socket.dev).
- Socket observed successful workflow runs in affected repositories. It saw no malicious releases on PyPI or crates.io as of 9 October 2026, which does not rule out misuse of the stolen credentials (socket.dev).
- IOCs: file name security-audit.yml, exfiltration address 193.32.204[.]199, compromised accounts henrywoo and kitao (socket.dev). No CVEs and no named threat actor are stated.
Remediação
- Rotate every secret named in the injected file, and revoke rather than rotate the GitHub personal access token (socket.dev).
- Treat any completed run of the injected workflow as a successful exfiltration of the named secrets (socket.dev).
- Scan the full git history, rotate every credential found there, and review CloudTrail for AWS keys that appear in history (socket.dev).
- Review PyPI and crates.io release history for unexpected versions published during and after the exposure window (socket.dev).
- Remove the workflow file and revert the commit in every affected repository, including organization-owned ones. Treat the maintainer accounts as fully compromised: revoke sessions, tokens and SSH keys and enforce phishing-resistant MFA (socket.dev).
- Beyond the Socket-specific cases, check your own repositories for unexpected workflow files and for cloud, AI or CI/CD secrets committed to source or git history.
Relatos divergentes
- Momentum: Dark Reading (darkreading.com, 28 October 2026) said the campaign appeared to be losing momentum on GitHub, while GBHackers (gbhackers.com, 9 November 2026) reports a new wave reaching tens of thousands of repositories. The GBHackers report is more recent and indicates the campaign is not fading.
- Scale: GBHackers (gbhackers.com) reports tens of thousands of repositories, while Infosecurity Magazine (infosecurity-magazine.com), citing Socket (socket.dev), counts 346 repositories for the 8 October 2026 variant. The sources may be measuring different waves or scopes, and the discrepancy is unresolved. Socket's count is the more specific and better documented.
- Focus: Dark Reading points to developer endpoints and cloud access, while GBHackers and Socket emphasise cloud and AI credentials in repositories and git history. These may be complementary rather than contradictory.
Linha do tempo
-
GhostAction variant plants credential-stealing workflow in 346 GitHub repos, including uber/athenadriver
ler a análise desta fonte ocultar
Socket's research team reports that a GhostAction variant committed a malicious workflow named security-audit.yml into 346 repositories on October 8, 2026, using two compromised maintainer accounts, henrywoo and kitao (socket.dev). The file presents itself as a security tool but performs no security function: it reads GitHub Actions secrets and, as the new element of this wave, scans working trees and full git history for cloud and AI service credentials before posting them over plain HTTP to 193.32.204[.]199 (socket.dev). The affected set includes the Uber-owned uber/athenadriver and the widely starred kitao/pyxel, and Socket observed the workflow running successfully in affected repositories. As of October 9, 2026 the malicious file was still on default branches, and Socket had seen no malicious releases on PyPI or crates.io, which does not rule out misuse of the stolen credentials. Urgency is high because the secrets may already be in attacker hands, although the operator needed maintainer write access that Socket did not see how they obtained.
Technical Details
- Two commits with the messages 'Add security audit workflow' and 'Update security audit workflow' added the file to every repository the two accounts could write to (socket.dev).
- Socket counted 318 henrywoo-namespace repositories (39 sources and 279 forks), 27 kitao repositories and uber/athenadriver; dormant repositories were included, which points to automated enumeration (socket.dev).
- The payload first lists the Actions secret names present in each repository and then embeds them in the file, so the secret list varies by repository (socket.dev).
- The added sweep uses regular expressions over the working tree and the full history (git log -p --all), so credentials deleted from the current branch can still be collected (socket.dev).
- The workflow triggers on push with no branch or path filter, so it runs on the next push to the default branch (socket.dev).
- Socket noted that the henrywoo forks carry the file too, and that subsequent pushes there can trigger harvesting if Actions is enabled (socket.dev).
Remediation
- Rotate every secret named in the injected file, and revoke rather than rotate the GitHub personal access token (socket.dev).
- Review PyPI and crates.io release history for unexpected versions published during and after the exposure window (socket.dev).
- Treat any completed run of the injected workflow as a successful exfiltration of the named secrets (socket.dev).
- Scan the full git history, rotate every credential found there, and review CloudTrail for AWS keys that appear in history (socket.dev).
- Remove the workflow file and revert the commit in every affected repository, including organization-owned ones, and treat the maintainer accounts as fully compromised: revoke sessions, tokens and SSH keys and enforce phishing-resistant MFA (socket.dev).
Conflicting Reports
- The article describes the compromise as affecting 'tens of thousands' of repositories; Socket's analysis counts 346 repositories where the file was observed, which is the more specific and authoritative figure (socket.dev).
- The article names 'kitao/pixel'; the repository Socket names is kitao/pyxel (socket.dev).
- The article says the affected kitao project is typically distributed through PyPI and crates.io; Socket states that the kitao/pyxel repository distributes through both registries (socket.dev).
-
GhostAction Attack Hits Tens of Thousands of GitHub Repositories to Steal Cloud and AI Credentials
ler a análise desta fonte ocultar
A new wave of the GhostAction supply chain campaign has pushed a credential-stealing GitHub Actions workflow into tens of thousands of repositories.
It now hunts for cloud and AI keys buried in source code and git history, in addition to CI/CD secrets.
-
darkreading.com ↗ · pub. 28/10/2026 16:39 · coletado 28/10 21:00 primeiro registro só resumo do feed
GhostAction supply chain campaign wanes but persists on GitHub, shifting toward developer endpoints and cloud access
ler a análise desta fonte ocultar
The GhostAction supply chain attack campaign targeting GitHub appears to be losing momentum, but the operators remain active on the platform. According to Dark Reading, the campaign is shifting its focus toward developer endpoints and cloud access. Dark Reading presents this shift as a possible indicator of what the cybercrime outfit behind it may target next. The article excerpt provides no further detail on victims, scale, IOCs or attribution.
Technical Details
- Campaign type: supply chain attack against GitHub-hosted development workflows.
- Reported evolution: increased targeting of developer endpoints and cloud access.
- No CVEs, IOCs or named threat actor are stated in the available text.
Remediation
The available text gives no remediation guidance.