- The GhostAction campaign expanded to more than 30,000 repositories and 3,000 users or organizations on Oct. 8 and 9, 2026.
- Attackers compromised roughly 1,900 GitHub accounts and tried to steal 3,174 secrets from public CI environments.
- Newer payloads scanned git history for AWS, GitHub, GitLab, cloud, and AI-related credentials.
- GitHub blocked the malicious workflow starting Oct. 9, preventing later waves from extracting secrets.
- Some victims were hit in earlier waves, suggesting unrotated secrets remain a key target.
The GhostAction credential-theft campaign soared on Oct. 8 and 9, 2026, expanding across more than 30,000 GitHub repositories and roughly 3,000 users and organizations. GitGuardian researchers Gaetan Ferry and Guillaume Valadon said the spike “resulted from compromising the GitHub accounts of about 1,900 users. It attempted to extract 3,174 secrets from public repositories’ CI.”
First documented in September 2025, GhostAction is a supply chain attack targeting developer infrastructure on GitHub. Attackers gain write access with stolen personal access tokens or infostealer credentials, then push deceptive workflow files such as “security-audit.yml” and “github_actions_security.yml.”
The ultimate goal is large-scale theft of CI/CD secrets, cloud credentials, package registry tokens, and AI provider API keys. Meanwhile, a new, more experimental wave has been active since Aug. 31, 2026, with payloads evolving over time.
GitGuardian said the first new payload added git-history secret-scanning. A second version captured two lines of context around AWS key ID hits, and a third supported retrieving secret context during scans.
These scanning checks targeted AWS key IDs, GitHub and GitLab tokens, AI-related secrets, and cloud API keys, as previously outlined by Socket and StepSecurity. The deployment unfolded in phases: first to 160 previously observed victims, then, 20 minutes later, to 28,000 new repositories between Oct. 8 and 9.
New waves appeared on Oct. 10 and 12. However, GitHub had started preventing the malicious workflow from running as of Oct. 9; consequently, those waves extracted no secrets.
A subset of victims in this burst had been compromised in the September 2025 and August 2026 waves, indicating attackers are banking on unrotated secrets.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
