GhostAction Campaign Compromises 1,900 GitHub Accounts and 30,000 Repositories
Threat actors exploit stolen credentials to inject malicious CI/CD workflows into developer repositories.
1Escalation of GhostAction Campaign
The GhostAction campaign significantly expanded its reach between October 8 and 9, 2026. Security researchers identified that attackers compromised approximately 1,900 GitHub accounts, impacting over 30,000 repositories. This operation represents a sophisticated supply chain attack targeting developer infrastructure, specifically aiming to extract sensitive secrets from public repositories' continuous integration and deployment pipelines.
2Infiltration via Stolen Credentials
Attackers gain unauthorized write access to repositories by utilizing stolen Personal Access Tokens or credentials harvested from infostealer logs. Once inside, they inject malicious GitHub Actions workflows disguised as legitimate security audits. These deceptive files, such as security-audit.yml, allow the actors to execute unauthorized commands within the victim's development environment.
3Objectives of Data Exfiltration
The primary goal of this campaign is the large-scale theft of critical CI/CD secrets and cloud credentials. Attackers specifically target package registry tokens for services like npm, PyPI, and DockerHub. Furthermore, the campaign seeks to acquire AI provider API keys, which are increasingly valuable for accessing sensitive data and automated systems.
4Evolution of Malicious Payloads
Since August 31, 2026, the campaign has shifted toward more experimental and manual payload deployments. The latest variants include advanced git history secret-scanning features using regular expressions. These tools are designed to identify AWS key IDs, GitLab tokens, and various cloud API keys, significantly increasing the potential impact of each successful compromise.
5Contextual Data Harvesting Techniques
The second version of the malicious payload captures two lines of context around every AWS key ID hit. This specific technique enables attackers to pair identified key IDs with their matching secret access keys. A third variant further enhances this capability by retrieving secret context during the git history scan process, maximizing data extraction.
6Phased Deployment and Mitigation
Attackers deployed the payload in multiple phases, initially targeting 160 previous victims before expanding to 28,000 new repositories. GitHub intervened on October 9, 2026, by preventing the malicious workflows from executing. Consequently, subsequent waves observed on October 10 and 12 failed to successfully extract any additional secrets from the targeted developer infrastructure.
7Persistence Through Unrotated Secrets
A notable subset of victims in the October burst were previously compromised during the September 2025 and August 2026 waves. This pattern indicates that threat actors are actively banking on the failure of developers to rotate their secrets after an initial breach. This persistence highlights the critical necessity of comprehensive credential management.
8Strategic Implications for Security
The GhostAction campaign underscores the vulnerability of automated CI/CD pipelines to supply chain attacks. As attackers leverage AI to accelerate reconnaissance and identity compromise, security teams must implement robust runtime identity controls. Discovering and controlling permissions for AI agents is now essential to reducing insider risk and preventing future large-scale data breaches.