Full Report
The credential-theft campaign known as GhostAction has ramped up, targeting more than 30,000 repositories across 3,000 users and organizations. The spike, according to GitGuardian, was observed on October 8 and 9, 2026. "This resulted from compromising the GitHub accounts of about 1,900 users. It attempted to extract 3,174 secrets from public repositories' CI," security researchers Gaetan
Analysis Summary
# Incident Report: GhostAction Supply Chain Campaign
## Executive Summary
GhostAction is a recurring supply chain attack campaign targeting developer infrastructure by hijacking GitHub accounts to inject malicious GitHub Actions workflows. The most recent spike in October 2026 compromised approximately 1,900 users, targeting over 30,000 repositories to exfiltrate CI/CD secrets, cloud credentials, and AI provider API keys. While the campaign was high-volume, GitHub intervened on October 9 to block malicious workflows, mitigating the impact of subsequent waves.
## Incident Details
- **Discovery Date:** October 8, 2026 (by GitGuardian)
- **Incident Date:** Ongoing; major spike observed October 8–12, 2026
- **Affected Organization:** 3,000+ unique users and organizations
- **Sector:** Technology / Software Development
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** August 31, 2026 (Start of new wave); October 8, 2026 (Mass escalation)
- **Vector:** Stolen Personal Access Tokens (PATs) and credentials harvested from infostealer logs.
- **Details:** Attackers gained write access to repositories by leveraging previously compromised developer credentials.
### Lateral Movement
- **Movement:** Attackers moved from compromised individual accounts to organization-wide repositories by utilizing the permissions associated with the hijacked PATs.
### Data Exfiltration/Impact
- **Exfiltration:** Attempted extraction of 3,174 secrets, including AWS key IDs, GitHub/GitLab tokens, npm/PyPI/DockerHub tokens, and AI API keys.
- **History Scanning:** Malicious workflows scanned git history for historical secrets, specifically capturing context lines around AWS keys to pair them with Secret Access Keys.
### Detection & Response
- **Detection:** GitGuardian researchers observed a massive spike in malicious workflow activity on October 8.
- **Response Actions:** GitHub began programmatically preventing the malicious workflows from executing starting October 9, 2026.
## Attack Methodology
- **Initial Access:** Valid accounts (via stolen PATs or infostealer logs).
- **Persistence:** Injection of malicious YAML workflow files into public repositories.
- **Privilege Escalation:** Not applicable; relied on existing write permissions of compromised tokens.
- **Defense Evasion:** Deceptive naming of workflows (e.g., `security-audit.yml`, `github_actions_security.yml`).
- **Credential Access:** Secret-detection regex used within CI/CD pipelines to harvest environment variables and historical secrets.
- **Discovery:** Automated scanning of public repositories where the hijacked user had write access.
- **Lateral Movement:** Using stolen secrets to potentially access cloud environments (AWS) or package registries (npm/PyPI).
- **Collection:** Automated extraction of CI/CD secrets and 2-line context hits for AWS keys.
- **Exfiltration:** Data sent to attacker-controlled infrastructure via malicious GitHub Action runners.
- **Impact:** Potential full takeover of cloud infrastructure or supply chain poisoning via registry tokens.
## Impact Assessment
- **Financial:** Unknown; potential for high costs due to unauthorized cloud resource usage or supply chain breaches.
- **Data Breach:** Attempted theft of 3,174 secrets across 30,000+ repositories.
- **Operational:** Disruption to CI/CD pipelines and requirement for mass secret rotation.
- **Reputational:** High impact for compromised organizations whose repositories were used to host malicious code.
## Indicators of Compromise
- **File indicators:**
- `security-audit.yml`
- `github_actions_security.yml`
- **Behavioral indicators:**
- Unexpected commits to `.github/workflows/` from maintainer accounts.
- Automated secret scanning regex patterns appearing in CI logs.
- Unusually high volume of GitHub Action runs on public repositories.
## Response Actions
- **Containment:** GitHub blocked the execution of known malicious workflow filenames.
- **Eradication:** Identification and removal of malicious YAML files from affected repositories.
- **Recovery:** Mandatory rotation of all secrets potentially exposed in CI/CD environments.
## Lessons Learned
- **Credential Hygiene:** Many victims were compromised in 2025 and 2026, indicating a failure to rotate secrets after the initial breach.
- **Workflow Monitoring:** Public repositories often lack sufficient monitoring for changes to automation workflows.
- **PAT Risks:** Personal Access Tokens provide a significant attack vector if not scoped narrowly or retired regularly.
## Recommendations
- **Rotate Secrets:** Implement a mandatory rotation policy for all CI/CD and Cloud provider secrets.
- **Enforce MFA:** Ensure all GitHub accounts, especially those with write access, require hardware-based Multi-Factor Authentication.
- **Fine-Grained PATs:** Move away from "Classic" PATs toward fine-grained, short-lived tokens with minimal required permissions.
- **Workflow Integrity:** Implement "CODEOWNERS" reviews for any changes to the `.github/` directory.