A large GitHub supply-chain campaign known as GhostAction has resurfaced, this time using compromised maintainer accounts to push credential-stealing workflows into hundreds of repositories and potentially expose secrets across tens of thousands of projects.
The campaign relies on stolen GitHub credentials, most likely personal access tokens taken from infostealer logs or credential dumps.
As soon as an account is compromised, attackers started to insert a workflow in GitHub Actions and name it something like Security Audit or GitHub Actions Security. The file can be mistaken for something normal and expected by developers.
But this file has other purposes. The workflow would perform a search of the repository and look for credentials and secrets: CI/CD tokens, AWS credentials and keys, GitHub and GitLab tokens, Docker Hub credentials, DB passwords, and API keys from OpenAI, Anthropic and OpenRouter among them.
However, the workflow does not stop with the repository files.
Also, it checks the repository history since sometimes developers have deleted a leaking secret from the latest version of the code but did not erase it from the previous versions. Anything found is then sent to attacker-controlled infrastructure.
Researchers linked the latest activity to compromised accounts belonging to high-profile open-source maintainers. In one case, the account of Takashi Kitao, author of the Pyxel game engine, was used to push the workflow into 27 repositories. Hours later, another compromised maintainer account pushed the same workflow into more than 300 repositories within minutes.
The wider scale is larger still. Researchers reported hundreds of affected GitHub accounts and malicious commits appearing across tens of thousands of repositories.
There is also a secondary risk from forks and mirrors.
If a repository carrying the malicious workflow is forked or synchronized downstream, the workflow can travel with it. Private forks are particularly concerning because they are more likely to contain real credentials and internal configuration data.
It demonstrates that it’s crucial to think of GitHub Actions files not only as configurations but rather as pieces of executable code. Companies are encouraged to scan their repositories for unrecognized workflow files, change any leaked GitHub access credentials, change any secrets that might have been compromised, check forks and mirrors and browse through the workflow history for unwanted alterations. GhostAction demonstrates how a hacked developer identity can escalate into a more complicated problem within the software supply chain.
Let’s refine your stalking skills; go through our Instagram and LinkedIn.
