Search — “GhostAction”

A brief item attributed to Dark Reading says the GhostAction supply-chain campaign has slowed its mass GitHub Actions compromises and is shifting toward developer endpoints and cloud access credentials. No source could be fetched, so the specific techniques, indicators, and affected versions are unverified. Hunters should treat this as awareness only until primary reporting is reviewed.

The GhostAction supply-chain campaign hijacked roughly 1,900 GitHub developer accounts and deployed a malicious GitHub Actions workflow (security-audit.yml or github_actions_security.yml) to about 28,000 new repositories on October 8-9, 2026, attempting to extract 3,174 secrets from public repositories' CI. The payload scans git history with regexes for AWS key IDs, GitHub/GitLab tokens, AI and cloud API keys, and captures context around AWS key IDs to pair them with secret access keys. GitHub began blocking the malicious workflow from running on October 9, so later waves on October 10 and 12 extracted nothing. Hunters should look for unexpected workflow files with these names added to repositories and for CI runs that scan git history for secret patterns.

The GhostAction campaign compromised roughly 1,900 GitHub developer accounts, using stolen PATs and infostealer-harvested credentials to push malicious GitHub Actions workflows (disguised as security-audit.yml or github_actions_security.yml) that attempt to extract CI/CD, cloud, package registry, and AI API secrets. The payload scans git history with regexes for AWS key IDs, GitHub/GitLab tokens, and AI and cloud keys, and later variants capture context around AWS key IDs to pair them with secret access keys. Hunters should look for newly added workflow files with these names in repositories and for workflow runs that perform git history secret scanning, noting that GitHub began blocking the malicious workflow from running starting October 9, 2026.