GhostAction: 1,900 GitHub Accounts Compromised in Renewed Supply Chain Attack Targeting AI API Keys

The credential-theft campaign known as GhostAction returned in force on October 8 and 9, 2026, when attackers using roughly 1,900 compromised GitHub accounts pushed malicious workflow files to more than 30,000 repositories across 3,000 users and organizations, attempting to extract 3,174 secrets including cloud credentials, package registry tokens and AI provider API keys, according to GitGuardian researchers Gaetan Ferry and Guillaume Valadon, whose update was published on October 13, 2026 and reported by The Hacker News on October 15, 2026.

What was the specific vulnerability?

The vulnerability was compromised developer credentials, not a flaw in GitHub itself: attackers obtained Personal Access Tokens (PATs) and other credentials, largely from infostealer logs and dumps, and used them to push malicious GitHub Actions workflow files into legitimate repositories. According to GitGuardian, the malicious workflows were disguised as security tooling, arriving under names such as "security-audit.yml" and "github_actions_security.yml". Once a workflow ran in a repository's continuous integration environment, it scanned the project for secrets and exfiltrated them to infrastructure controlled by the attackers.

The payload's secret-scanning feature used 11 detection regexes covering AWS key IDs, GitHub and GitLab personal access tokens, npm, PyPI and DockerHub registry tokens, AI-related secrets and other cloud credentials. The October payload evolved through three versions, each documented by GitGuardian's researchers. Version 1 added git-history secret scanning and was deployed to approximately 1,800 repositories. Version 2 added context retrieval around AWS key IDs and case-insensitive matching, reaching about 100 repositories. Version 3 added secret context in history scanning, extending the amount of surrounding material captured alongside each match. Exfiltration went to the attacker-controlled IP address 193.32.204.199 via HTTP POST, with six batch labels observed across the campaign, a detail GitGuardian used to group and track the stolen data as it left victim environments.

How was the incident detected?

The campaign was detected and tracked by GitGuardian security researchers Gaetan Ferry and Guillaume Valadon, who published their analysis of the October spike on October 13, 2026. GhostAction was originally discovered in September 2025 and was previously outlined by Socket and StepSecurity, per The Hacker News. GitGuardian's researchers reconstructed the campaign's timeline from workflow deployments and exfiltration traffic, documenting that a new wave had been underway since August 31, 2026, and that between August 31 and September 30, 2026 the attackers hit 772 public repositories targeting 2,577 secrets.

The researchers also identified the phased deployment of the v3 payload in detail. The first phase reached 160 previously observed victims, and then, 20 minutes later, the second phase pushed the updated payload to 28,000 new repositories between October 8 and 9. That staging, first re-touching known victims and then expanding to a far larger set, is what produced the October burst of more than 30,000 targeted repositories attributed to about 1,900 compromised accounts.

What is the current impact?

The immediate impact is a large-scale exposure of CI/CD secrets, with AI provider API keys among the categories the attackers explicitly sought. GitGuardian's researchers stated: "This resulted from compromising the GitHub accounts of about 1,900 users. It attempted to extract 3,174 secrets from public repositories' CI." GitHub began preventing the malicious workflow from running on October 9, 2026, which neutralized subsequent waves on October 10 and October 12, consisting of 84 and 65 commits respectively; per GitGuardian, those later waves "could not extract any secrets."

A persistent risk remains, however. Part of the victims in the new burst had already been hit in the September 2025 and August 2026 waves, and GitGuardian noted: "The threat actors are likely relying in part on unrotated secrets compromised months or years ago." In other words, victims who failed to rotate credentials after earlier waves remain exposed even though GitHub is now blocking the workflow. GitGuardian also observed that the actor "planned to affect private repositories," since scanning repository contents adds no value for public ones, suggesting the public-repository activity may not represent the full scope of the operation's intent.

What are the next steps?

The next steps are credential rotation and workflow auditing for anyone touched by the campaign, including organizations that were hit in earlier waves and never rotated their secrets. GitGuardian's finding that attackers relied on unrotated secrets from months or years earlier makes rotation the central remediation: any PAT, AWS key, registry token or AI provider API key that existed in an affected repository's CI environment or git history should be treated as compromised and replaced. Repository owners should also review their GitHub Actions workflow files for unexpected files named "security-audit.yml" or "github_actions_security.yml" and audit their account security for signs of PAT misuse, since the campaign's entry point was stolen credentials rather than a platform defect.

For the broader ecosystem, GitHub's October 9 blocking of the malicious workflow demonstrates that platform-level mitigation is in place for this specific payload, but the underlying credential-theft supply chain, which has now operated across at least three waves since September 2025, remains active. The August 31 to September 30 window, in which 772 repositories were hit and 2,577 secrets were targeted, shows the campaign sustained activity between the major bursts, and defenders should expect further variants building on the v1, v2 and v3 payloads already documented.

By the numbers

Source snapshot