As reported by The Hacker News, the GhostAction supply chain campaign has entered a dangerous new phase, compromising approximately 1,900 GitHub accounts and targeting over 30,000 repositories in a coordinated burst on October 8–9, 2026. GitGuardian researchers attribute the escalation to stolen Personal Access Tokens (PATs) and credentials harvested from infostealer dumps, giving attackers write access to inject malicious GitHub Actions workflows disguised as security audits.
What makes GhostAction particularly insidious is its abuse of trusted CI/CD infrastructure. By injecting a workflow file named security-audit.yml or github_actions_security.yml, attackers turn GitHub's own automation platform into a credential exfiltration engine. The payload has evolved across three iterations — adding git history secret-scanning, AWS key context capture, and full secret-context retrieval — demonstrating iterative refinement typical of a well-resourced operation.
The attack surface isn't a vulnerability in GitHub itself — it's the intersection of credential hygiene, over-permissioned tokens, and unmonitored CI/CD pipelines.
Why This Matters Beyond GitHub
The secrets targeted — AWS credentials, npm/PyPI/DockerHub tokens, and AI provider API keys — represent the keys to downstream infrastructure. A single exfiltrated cloud credential can lead to data exfiltration, lateral movement, or further supply chain poisoning. The 3,174 secrets extraction attempts from CI environments suggest the attackers are casting a wide net, banking on the probability that some percentage will yield high-value access.
The fact that GitHub began blocking the malicious workflow on October 9 is encouraging, but the two subsequent waves on October 10 and 12 indicate the attacker is persistent and adaptive. The 28,000-repository deployment in a single coordinated push also signals automation at scale — this isn't a manual operation anymore.
Who Is Most at Risk
Shield53 Recommendations
Immediate Actions
- Audit GitHub Actions workflows across all repositories for unexpected files, particularly anything named
security-audit.ymlor similar security-themed disguises. Check git history for pushed-then-removed workflows. - Rotate all secrets that may have been exposed in CI environments — assume compromise if your repositories were targeted. This includes AWS keys, registry tokens, and AI API keys.
- Revoke and replace all PATs across your organization. Move to fine-grained tokens with short expiration and least-privilege repository scopes.
- Review GitHub audit logs for October 8–12 for unexpected workflow runs, repository permission changes, or new Actions triggered by compromised accounts.
Hardening Measures
- Enforce branch protection rules requiring pull request review for workflow file changes — block direct pushes to
.github/workflows/ - Enable GitHub's secret scanning and push protection at the organization level to catch credentials before they enter git history
- Adopt OIDC federation for cloud deployments instead of storing long-lived cloud credentials in GitHub Actions
- Implement token inventory and rotation automation — if a token can't be tracked and rotated, it's a liability
- Restrict Actions permissions using the
permissionskey in workflows to read-only by default, escalating only where necessary
The broader lesson from GhostAction is that CI/CD platforms are now prime targets in the supply chain kill chain. The credentials that power your build pipelines are effectively infrastructure credentials — they deserve the same protection as production access keys. Organizations that continue treating CI secrets as second-class citizens will keep finding themselves in breach reports.
