GhostAction GitHub Actions Credential-Stealing Attack
GhostAction deployed malicious GitHub Actions workflows to more than 34,000 repositories in a single day. The attack leveraged compromised maintainer accounts to push a workflow file named security-audit.yml or github_actions_security.yml. The file contains a single step that collects all repository secrets, AWS credentials, OpenAI API keys, and GitLab tokens, then sends them to the hard-coded IP address 193.32.204.199 over plain HTTP.
The first evidence surfaced on Oct 7, 2026, when StepSecurity identified a push from Takashi Kitao’s account at 13:20 UTC. Within 30 minutes, Henry Wu’s account pushed the same workflow to 318 additional repositories. By Oct 9, Socket blog reported that more than 500 GitHub accounts had committed the workflow to tens of thousands of repositories. The rapid propagation demonstrates that the attackers used automated scripts to scan for accounts with write access and then push the malicious file.
Attack Path and Exposure
- Compromise of maintainer accounts – The attackers gained access to personal access tokens (PATs) or SSH keys belonging to repository maintainers. The compromised credentials were used to push the malicious workflow.
- Workflow deployment – The workflow file is added to the .github/workflows directory. GitHub automatically triggers the workflow on every push to the default branch.
- Secret collection – The workflow runs a script that enumerates all secrets defined in the repository and any secrets injected by the GitHub Actions runtime.
- Exfiltration – The collected data is transmitted to 193.32.204.199 via an HTTP POST request. The use of plain HTTP means the traffic can be captured by any network monitoring tool.
Repositories that had not previously enabled secret scanning or had weak branch protection policies were most vulnerable. The attack bypassed GitHub’s default branch protection because the malicious workflow was added to the default branch itself.
Concrete Evidence
- Oct 7, 2026, 13:20 UTC – Takashi Kitao’s account pushed the workflow to 27 repositories.
- Oct 7, 2026, 21:10–21:26 UTC – Henry Wu’s account pushed the workflow to 318 repositories.
- Oct 9, 2026 – Socket blog reported over 500 accounts had committed the workflow to tens of thousands of repositories.
- IP address – 193.32.204.199 is the sole exfiltration endpoint.
- Data captured – GitHub Actions secrets, AWS keys, OpenAI API keys, GitLab tokens.
Mitigation Steps
- Revoke compromised PATs – Immediately revoke any PATs that may have been used by attackers. Generate new tokens with the minimum scopes required.
- Audit workflow files – Search all repositories for .github/workflows/security-audit.yml or github_actions_security.yml. Remove any unknown or unauthorized workflow files.
- Block outbound traffic – Add a firewall rule to block traffic to 193.32.204.199. This stops exfiltration even if the workflow remains.
- Enable secret scanning – Turn on GitHub’s secret scanning feature to detect accidental exposure of secrets in code.
- Enforce branch protection – Require pull request reviews and status checks before merging changes to the default branch.
What to Watch Next
- New exfiltration endpoints – Attackers may rotate IP addresses. Monitor outbound traffic for new destinations.
- Supply-chain attacks on other CI/CD platforms – Similar tactics could target GitLab CI, Azure Pipelines, or Bitbucket Pipelines.
- Credential reuse – If attackers reused the same PATs across multiple accounts, the compromise could extend beyond the initial 34,000 repositories.
Related Coverage
- How SMB Cybersecurity Complexity Threatens Advanced Protection Goals
- Microsoft Twitter Account Hijacked for Crypto Scam Featuring Clippy
- Threat Actors Exploit AI Chatbot Security Vulnerabilities for Mass Disinformation and Phishing Campaigns