Github repos compromised

GhostAction is a credential-theft campaign targeting developer infrastructure on GitHub by compromising legitimate user accounts. Attackers use stolen Personal Access Tokens or credentials from infostealer logs to gain write access and push malicious GitHub Actions workflows disguised as security audits. These workflows scan repository git history for secrets such as AWS keys, cloud API keys, package registry tokens, and AI provider API keys. The campaign, active since September 2025, escalated in October 2026 with a new payload that added git history secret scanning and context capture features. GitHub started blocking the malicious workflows on October 9, 2026, limiting the attack's impact in subsequent waves.

The attack compromises developer accounts and repositories, enabling theft of sensitive CI/CD secrets and credentials that could be used to access cloud services, package registries, and AI providers. This can lead to further supply chain compromises and unauthorized access to critical infrastructure. The scale of the attack affected thousands of repositories and users, with repeated compromises of previously affected victims due to unrotated secrets.

GitHub has taken action to prevent the malicious workflows from running starting October 9, 2026, effectively mitigating further secret exfiltration from new waves of the attack. Users are advised to rotate all secrets and credentials that may have been exposed and review repository workflows for unauthorized changes. No additional vendor advisory indicates further remediation steps at this time.