- Two high-profile open-source maintainer accounts were compromised, pushing a malicious workflow into over 340 repositories.
- The GhostAction campaign has stolen thousands of secrets, including AI API keys, cloud credentials, and GitHub tokens.
- Attackers also injected an XMRig cryptocurrency miner into a Docker image in one repository, though no malicious packages have been published yet.
Cybersecurity researchers have disclosed an ongoing credential-theft campaign that compromised two prominent open-source maintainer accounts, pushing a malicious workflow into over 340 repositories. The campaign, attributed to GhostAction, first came to light in September 2025 and has now expanded significantly, according to StepSecurity.
The attacker used the account of Takashi Kitao to push a malicious workflow to 27 repositories, and eight hours later, the account of Henry Wu pushed the same workflow to 318 repositories within 16 minutes. Socket reported that over 500 GitHub accounts have committed the malicious workflow to tens of thousands of repositories since October 7, 2026.
The workflow exfiltrates sensitive data including CI/CD secrets, cloud credentials, and AI API keys to a hard-coded IP address over plain HTTP. The attack chain involves obtaining a maintainer’s GitHub credentials, scanning repository secrets, and injecting a malicious workflow under the victim’s identity, as noted in a previous StepSecurity report.
GitGuardian noted that the campaign pushed the malicious workflow to 772 public repositories between August 31 and September 30, 2026. In one case, attackers altered a repository to embed an XMRig cryptocurrency miner in the project’s Docker image.
Developers are advised to check their repositories for the malicious workflows and assume compromise if present. Affected users should revoke compromised credentials and delete the malicious workflows from all branches.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
