GhostAction returns: hijacked GitHub accounts push secret-stealing 'security audit' workflows to 30k+ repos
› GitHub repositories / GitHub Actions (compromised maintainer accounts)
Get an email when a new major security incident drops. No spam, unsubscribe any time.
- started
- Oct 8, 2026
- closed
- ongoing
- CVEs
- none
- sources
- 6
## summary
GhostAction, a campaign first documented by GitGuardian in Sept 2025, came back in 2026. It hit 772 repos in Aug-Sep 2026, then surged on Oct 8-12: about 1,900 compromised GitHub accounts pushed fake 'security audit' workflows to 30,000+ repositories (GitGuardian). The new payload exfiltrates the repo's Actions secrets plus every credential found in the full git history to 193.32.204.199 over plain HTTP. GitHub began preventing the workflow from running around Oct 9. The operator moved on to GitHub-themed phishing (my-github.com) and a VS Code tasks.json + fake .woff2 font stealer found in 94 repos.
severity: Mass CI/CD secret theft; workflows confirmed to have run and exfiltrated (e.g. uber/athenadriver)
## affected
- Repos where a compromised account pushed security-audit.yml / github_actions_security.yml (Oct 8-12 2026 wave), and repos with the tasks.json + public/fonts/fa-solid-400.woff2 second stage
## fixed in
no fixed release yet
## timeline[7]
OpenSourceMalware finds a second stage in 94 repos: VS Code tasks.json autoruns a stealer hidden in a fake Font Awesome .woff2 and installs a 5-minute cron.
sourceGitGuardian update: Oct 8-12 wave targeted 30,000+ repos across ~3,000 users/orgs from ~1,900 compromised accounts; 3,174 secrets targeted.
sourcePhishing kit on my-github.com steals password + 2FA and silently authorizes an OAuth app with repo/workflow scopes.
sourceSocket counts 500+ accounts committing the workflow to tens of thousands of repos; GitHub starts preventing the workflow from running; my-github.com registered.
sourceAccounts of pyxel author Takashi Kitao (27 repos, 13:20 UTC) and henrywoo (318 repos in 16 min, incl. uber/athenadriver) push security-audit.yml; run logs confirm exfiltration.
source2026 resurgence: 772 public repos and 2,577 secrets targeted between Aug 31 and Sep 30; new exfil IP 193.32.204.199 in use from ~Sep 4.
sourceGitGuardian first documents GhostAction: 817 repos, 327 users, 3,325+ secrets stolen. (Earlier campaign, for context.)
source
## news & write-ups[5]
- The campaign that never stopped: tracking GhostAction from 2025 to 2026GitGuardian · Oct 13, 2026 · write-up
- GhostAction Returns: Malicious 'Security Audit' Workflows Now Mine Credentials from Entire Git HistoriesStepSecurity · Oct 9, 2026 · write-up
- New GhostAction Wave Hits Hundreds of Repos, Expanding Beyond CI/CD Secrets to Cloud CredentialsSocket · Oct 9, 2026 · write-up
- GhostAction Copycats PolinRider by Hiding a Stealer in a Fake Font FileOpenSourceMalware · Oct 16, 2026 · write-up
- GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub RepositoriesThe Hacker News · Oct 19, 2026
## posts[1]
#ThreatProtection GhostAction now phishes open-source maintainers with fake GitHub sign-in alerts to steal credentials, 2FA codes and OAuth tokens. Read more about Symantec’s protection: t.co/GN7LOBQNZj
## notes & caveats
This is a real Oct 2026 wave of a campaign that began in Sept 2025, not just the old 2025 incident. Link to Shai-Hulud/ChainDrop: NOT verified as the same operator. GitGuardian says GhostAction's workflow-injection technique was later reused by Shai-Hulud and is still at the core of the Mini Shai-Hulud family, and Socket ties ChainDrop to Shai-Hulud (tensorlake, Oct 8, same day). But no primary source links the infrastructure or actor. Present it as a shared technique and timing only. patchStatus partial: GitHub blocks the workflow, but stolen secrets stay valid until rotated, the second stage persists on dev machines, and the phishing continues.
