Cutsign — GhostAction: about 1,900 GitHub accounts reported compromised to push secret-stealing Actions workflows

AI-generated verdict card, published automatically by the pipeline on day one because the brief rated the story P1. Version 1, as of 2026-10-31; hype score 2 (below the usual publish bar: early read from few sources, revised as the story develops). Written by a model from the stored public sources and not reviewed by a person; re-issued in place when the evidence changes (the URL stays). The detection-coverage table below is checked automatically from public sources and re-checked daily. All cards

GhostAction: about 1,900 GitHub accounts reported compromised to push secret-stealing Actions workflows

Hunt + hardenP1confidence: lowP1 +2P1: card on day one (score below the publish bar; revised as the story develops)

One trade report says a campaign used stolen GitHub credentials to add fake 'security audit' workflows that try to pull CI/CD, cloud, registry and AI secrets. Today, search your GitHub organisations for the two named workflow files. Rotate any secret reachable from a repository where they appear.

Triage: A successful run exposes cloud, registry and AI secrets that stay valid until rotated, across a large reported victim set [S1].

Single secondary source (The Hacker News). No GitHub advisory or primary researcher report is in the input.

What happened

Roughly 1,900 GitHub developer accounts were reported compromised, with over 30,000 repositories targeted [S1].
Attackers gained write access using stolen Personal Access Tokens (PATs) and infostealer-harvested credentials [S1].
They pushed malicious GitHub Actions workflows named security-audit.yml or github_actions_security.yml, disguised as 'Security Audit' [S1].
The workflows attempt to extract CI/CD, cloud, package registry and AI API secrets. Regexes scan git history for AWS key IDs, GitHub/GitLab tokens, and AI and cloud keys [S1].
Later variants capture the text around AWS key IDs to pair them with secret access keys [S1].
GitHub began blocking the malicious workflow from running starting October 9, 2026 [S1].

Timeline

2026-10-09	GitHub begins blocking the malicious workflow from running S1
2026-10-15	Campaign reported: about 1,900 accounts compromised, over 30,000 repositories targeted S1

Detect

GhostAction workflow file names in repository or audit data · GitHub audit log / repository commit history

index=* ("security-audit.yml" OR "github_actions_security.yml") | stats earliest(_time) as first_seen latest(_time) as last_seen count by repo, actor, action

FROM logs-* | WHERE message LIKE "*security-audit.yml*" OR message LIKE "*github_actions_security.yml*" | STATS first_seen = MIN(@timestamp), last_seen = MAX(@timestamp), count = COUNT(*) BY github.repo, user.name, event.action

A hit means: A file with a GhostAction workflow name was added or referenced in a repository. Check which account pushed it and whether it ran.

Workflow runs named Security Audit · GitHub audit log (workflows events)

index=* action="workflows.*" ("Security Audit" OR "security-audit.yml" OR "github_actions_security.yml") | stats count values(action) as actions by repo, actor

FROM logs-* | WHERE event.action LIKE "workflows.*" AND (message LIKE "*Security Audit*" OR message LIKE "*security-audit.yml*" OR message LIKE "*github_actions_security.yml*") | STATS count = COUNT(*), actions = VALUES(event.action) BY github.repo, user.name

A hit means: A workflow matching the campaign's disguise was created or executed. If it ran, treat every secret available to that repository as exposed.

Verify

Open the workflow file and its commit. A true positive scans git history with secret regexes (AWS key IDs, GitHub/GitLab tokens, AI and cloud keys) and sends the results out [S1].
Confirm the pushing actor and token. Unexpected PAT use, or an account linked to a known infostealer infection, supports compromise [S1].
Benign look-alike: legitimate internal or third-party security-scanning workflows may use similar names such as security-audit.yml. Compare against your change records and the commit author.

Scope

Affected

GitHub repositories where an attacker held write access via a stolen PAT or credential [S1]
Secrets available to GitHub Actions in those repositories, plus secrets committed anywhere in git history [S1]

Only if

An account or PAT with write access to the repository was compromised [S1]
The malicious workflow ran; GitHub reports blocking it from October 9, 2026 [S1]

Not affected if

None stated by the sources.

Enumerate

All repositories in your GitHub organisations containing the two named workflow files, including in branches and history
PATs and accounts with write access, especially long-lived classic PATs
Repository, environment and organisation Actions secrets per affected repository
Secrets ever committed to git history in affected repositories (AWS, GitHub/GitLab, cloud, AI, package registry)
Developer endpoints with infostealer detections in the relevant period

Contain

Preserve evidence first: export GitHub audit logs, workflow run logs and the malicious commits before deleting anything.
Disable Actions on affected repositories, or disable the malicious workflow.
Revoke the PATs and reset credentials for the accounts that pushed the workflow.
Rotate every secret reachable from affected repositories and git history. Rotation stops future use; it cannot undo exposure that already happened.
Review cloud, registry and AI provider logs for use of the exposed keys.

Eradicate

Remove the malicious workflow files and any attacker commits.
Remove the compromised access path: stolen PATs and infostealer-harvested credentials [S1]. Reimage developer machines with infostealer infections.
Remove secrets from git history where feasible. Rotation remains the real fix.

Recover

Before re-enabling Actions, validate that workflow files match approved versions and that all secrets have been rotated.
Monitor for new workflow files added by unexpected actors, and for PAT use from unfamiliar sources.
Watch cloud and registry accounts for activity from the old, rotated keys.

Re-enter the loop when

GitHub or a primary researcher publishes IoCs, exfiltration endpoints or additional workflow names
New variants appear that bypass GitHub's October 9 blocking [S1]
Exposed keys show use in cloud, registry or AI provider logs
Compromise is found to extend to GitLab or other platforms whose tokens the payload targets

Debrief

Record which repositories, accounts, PATs and secrets were involved, plus rotation times.
Record whether the workflow ran before or after GitHub's October 9 blocking.
Gap: no exfiltration destination or network IoCs in the source.
Gap: no primary GitHub advisory or researcher report in the input.
Gap: the source does not say how the infostealer infections were delivered.

Detection coverage — checked automatically

Category	Source	Status
Vendor	Impacted vendor / CERT advisory	nothing found — no vendor or CERT page among the thread sources; secondary reporting only
Government	CISA KEV	not checkable — no CVE: the catalog is keyed by CVE
EDR / endpoint VM	CrowdStrike blog	nothing found — no post names it among the feed's 10 newest items
EDR / endpoint VM	Microsoft Security blog	published — FORGE Lab uses agentic tools to identify memory safety issues in Rust · ARTEX abuse expands as cybercriminals target financial sector · Threat actors use agentic AI tooling to find and abuse exposed secrets (names the campaign in the title; the feed text carries no CVE id)
EDR / endpoint VM	SentinelOne blog	published — Bring Your Own Vulnerable Driver: What Detection Teams Should Actually Hunt · Bring Your Own Vulnerable Driver: The Trust Gap Attackers Operate Inside · Bring Your Own Vulnerable Driver: How EDR Killing Became an Industry (names the campaign in the title; the feed text carries no CVE id)
EDR / endpoint VM	SentinelOne Labs	nothing found — no post names it among the feed's 10 newest items
WAF / edge	Akamai blog	nothing found — no post names it among the feed's 1183 newest items
WAF / edge	Cloudflare WAF managed-ruleset changelog	nothing found — no post names it among the feed's 139 newest items
Cloud / container	Wiz blog	published — The Pwn Request Reckoning: What Still Works Against GitHub Actions · Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles · The Blue Agent POV: Investigating Multi-Platform Data Exfiltration Across AWS and GitHub (names GitHub in the title; the feed text carries no CVE id)
IDS / research	Cisco Talos blog	published — A quiet week in infosec <.< · IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases · NIK C2: The new AI-enabled command-and-control framework (names the campaign in the title; the feed text carries no CVE id)
Detection content	Elastic detection rules	published — 3 files name GitHub: rules/integrations/github/impact_github_repository_deleted.toml, README.md, NOTICE.txt
Detection content	Elastic Security Labs	published — Modernising threat hunting: Using Semantic Search to Find Risky AI Agent Behavior · Auditing the auditor: Unmasking Apex Accelerator · Behind the tags: How Elastic SIEM grades 1,781 detection rules on noise, speed, and threat coverage (names the campaign in the title; the feed text carries no CVE id)
Detection content	SigmaHQ rules	published — 23 files name GitHub: rules/application/github/audit/github_new_org_member.yml, deprecated/windows/net_connection_win_binary_github_com.yml, rules/application/github/audit/github_new_secret_created.yml, rules/application/github/audit/github_delete_action_invoked.yml
Detection content	Splunk ESCU	published — 4 files name GitHub: macros/deprecated/github.yml, macros/github_enterprise.yml, macros/github_organizations.yml, macros/deprecated/evilginx_phishlets_github.yml
MSSP / IR firms	Arctic Wolf blog	nothing found — no post names it among the feed's 10 newest items
MSSP / IR firms	Huntress blog	nothing found — no post names it among the feed's 754 newest items
MSSP / IR firms	Rapid7 blog	published — Metasploit Wrap Up: Langflow, MongoDB, and More · From One Account to Every Mailbox: Breaking Zimbra's Identity Boundaries (Part 1) (names the campaign in the title; the feed text carries no CVE id)
MSSP / IR firms	Sophos threat research	nothing found — no post names it among the feed's 15 newest items
Research	Unit 42	published — Blinder Tunnel Campaign Targets Iraqi Infrastructure (names the campaign in the title; the feed text carries no CVE id)

Checked automatically 2026-11-10 08:02Z from public sources: 10 published, 8 nothing found, 1 not machine-checkable, 0 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.

What a person would still look up (5)

Source code / CI-CD security	Can it alert on new or modified files in .github/workflows by unexpected actors?
Secret scanning	Does it inventory secrets in git history across all organisation repositories?
SIEM	Are GitHub audit logs, including workflows and git events, ingested, and with which field names?
EDR	Does it detect infostealer activity on developer endpoints?
Cloud security / CSPM	Can it flag API use from rotated or anomalous access keys?

Exposure queries — generated automatically

No CVE in this campaign: nothing an internet scanner keys on. Scope by product in your own tool.

Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-11-10 08:02Z from the CVE ids and NVD's CPE configurations, each Shodan query counted against Shodan itself; re-built daily with the coverage check.

Open questions

Is there a GitHub or primary researcher advisory confirming the counts and blocking date?
Where are stolen secrets sent? No exfiltration endpoint is given.
Do the GitHub audit log fields in your SIEM expose workflow file names or only workflow names?
Were any financial-sector repositories among the reported targets?

Sources

[S1] https://thehackernews.com/2026/10/ghostaction-compromises-about-1900.html · The Hacker News

Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically; a dismissed draft unpublishes it.