Quick Takeaways
- The GhostAction campaign has compromised over 1,900 GitHub accounts to inject malicious workflows, aiming to steal CI/CD secrets, cloud credentials, and API keys through deceptive file names and hijacked permissions.
- Attackers exploit stolen Personal Access Tokens (PATs) and harvested credentials to gain write access, deploying evolving payloads with secret-scanning features that target cloud keys and sensitive information.
- Despite GitHub’s blocking efforts, the threat actors continue reusing unrotated secrets across multiple waves, significantly amplifying the risk of large-scale data exfiltration and supply chain disruptions.
Threat, Attack Techniques, and Targets
The GhostAction campaign is a credential-theft attack targeting GitHub developer accounts. It focused on compromising nearly 1,900 user accounts. The attackers gained access to over 30,000 repositories, mainly by stealing Personal Access Tokens (PATs) or credentials from infostealer logs and dumps. Once they took control of a developer’s account, they could push malicious workflows into repositories. These workflows were created with deceptive names like “security-audit.yml” to appear legitimate. The goal was to steal secrets from continuous integration (CI) and deployment (CD) processes. The attack started in September 2025, but a new wave began around August 31, 2026. In this phase, the threat actors made their payloads more advanced, including secret scanning features that could detect and retrieve cloud API keys, tokens, and secrets from Git history. The activity mainly targets software developers and organizations using GitHub for hosting their code.
Impact, Security Implications, and Remediation Guidance
The GhostAction campaign can lead to significant security issues. Stolen secrets, such as cloud credentials and API keys, can be used for further hacking, data theft, or account compromise. This impacts the security of the affected organizations and their software supply chains. The attack highlights vulnerabilities in account security and secret management. If organizations suspect they have been targeted, they should review their repositories for malicious workflows and rotate compromised secrets immediately. Since the campaign involves stolen credentials, rotating credentials and updating access tokens are critical steps. For detailed remediation guidance, organizations should consult with the affected vendors or security authorities. Existing security measures should be reinforced to prevent similar attacks.
Stay Ahead with the Latest Tech Trends
Dive deeper into the world of Cryptocurrency and its impact on global finance.
Explore past and present digital transformations on the Internet Archive.
ThreatIntel-V1
