# GhostAction GitHub Attack Hijacks About 1,900 Developer Accounts

- URL: https://usa-24.com/ghostaction-github-attack-explained/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-16T08:50:23.182Z
- Updated: 2026-10-16T11:55:02.786Z
- Topics: Cybersecurity, GitHub, Supply Chain Attacks, Credential Theft, Open Source Security

> The GhostAction campaign has taken over about 1,900 GitHub accounts and planted credential-stealing workflows in tens of thousands of repositories, and it is still producing new waves.

## Key takeaways

- GitGuardian says the GhostAction campaign compromised about 1,900 GitHub accounts and targeted more than 30,000 repositories.
- Attackers hide malicious workflows under names such as security-audit.yml to steal CI/CD secrets, cloud credentials, package registry tokens and AI provider keys.
- GitHub began blocking the malicious workflows from running on October 9, but new waves using the same payload were still observed on October 10 and 12.
- Deleting the workflow does not end the exposure, so maintainers must revoke the compromised GitHub credential and rotate every secret the workflow could reach.
- By October 5, only 16% of affected repositories from the August to September wave had been cleaned up, according to researchers.

## What GhostAction is and why it is spiking now

The GhostAction GitHub attack has taken over about 1,900 developer accounts and planted malicious workflows in more than 30,000 repositories, according to [The Hacker News](https://thehackernews.com/2026/10/ghostaction-compromises-about-1900.html). Researchers reported a fresh surge on October 15, one week after a spike on October 8 and 9. The campaign is still producing new waves.

The prize is the credentials developers keep in their code. Cloud keys, package-registry tokens and AI API keys stored in repositories are what the attackers want, and one stolen developer login can expose an entire organization's pipelines.

GhostAction is not new. [GitGuardian first disclosed it in September 2025](https://blog.gitguardian.com/ghostaction-campaign-3-325-secrets-stolen/), when it had compromised 327 GitHub users across 817 repositories and stolen 3,325 secrets. A [DEV Community analysis](https://dev.to/rbonweb/ghostaction-has-hit-github-repos-three-times-since-2025-and-it-never-actually-stopped-1mmg) counts three separate waves against GitHub repositories since 2025 and argues the activity never fully stopped.

## How the malicious workflows steal secrets

The attackers push GitHub Actions workflow files with names that look routine, such as security-audit.yml or github_actions_security.yml. Once a workflow runs, it is built to harvest CI/CD secrets, cloud credentials, package registry tokens and AI provider keys, according to [daily.dev's summary of the reporting](https://daily.dev/posts/hackers-hijacked-1-900-github-accounts-then-they-went-after-30-000-repos--jyzqln0ak).

The method differs from the best-known precedent. The earlier tj-actions/changed-files incident poisoned a shared GitHub Action. GhostAction instead used stolen developer credentials to modify workflows directly in victims' own repositories, and it did not exploit a flaw in GitHub Actions itself.

That distinction changes the fix. A poisoned shared action can be patched once by its maintainer. A stolen login has to be dealt with account by account, repository by repository.

The payload also reads full git history. Anything ever committed may be exposed, not only the secrets sitting in current files, according to [a DEV Community report on the campaign](https://dev.to/etairos/ghostaction-returns-fake-security-audit-workflow-steals-secrets-from-tens-of-thousands-of-github-3ca8). A key that was removed from a file years ago can still be recoverable from an old commit.

The rollout happened in phases. The Hacker News quoted researchers Gaetan Ferry and Guillaume Valadon saying, “This payload was deployed in multiple phases.” GitGuardian described a first phase against 160 previously observed victims, followed by about 28,000 new repositories between October 8 and 9.

## Which accounts and repositories were hit

The counts vary by source because each team used different time windows and methods. GitGuardian reports about 1,900 compromised GitHub accounts, more than 30,000 targeted repositories and roughly 3,000 users and organizations, with 3,174 secrets targeted in the October wave.

Socket's October 9 update reported more than 500 compromised GitHub maintainer accounts since October 7, with tens of thousands of repositories affected, according to [CyberPress](https://cyberpress.org/ghostaction-attack-compromises-500-github-accounts/). That figure reflects an earlier snapshot and a different counting window. It is not a retraction of the larger count.

GitGuardian's latest disclosure covers a separate window, August 31 to September 30, 2026. In that period, 772 public repositories belonging to 373 users and organizations had 2,577 secrets targeted by name, per [Cybersecurity News](https://cybersecuritynews.com/ghostaction-supply-chain-campaign/).

| Campaign window | Repositories | Users or organizations | Secrets targeted |
|---|---|---|---|
| September 2025 original campaign | 817 | 327 users | 3,325 |
| August 31 to September 30, 2026 | 772 | 373 | 2,577 |
| October 2026 wave | More than 30,000 | About 3,000 | 3,174 |

Early October targets included maintainer accounts tied to Uber's athenadriver and the pyxel game engine, two very different projects, according to [StepSecurity](https://www.stepsecurity.io/blog/ghostaction-returns).

Reuse is the part that should worry maintainers most. Attackers reused 92 earlier malicious workflows, and by October 5 only 16% of affected repositories from the August to September wave had been cleaned up.

## Why deleting the workflow is not enough

Deleting the workflow file is necessary but not sufficient. Researchers stress that the stolen access token is the persistent problem. Removing the workflow or rotating only the exfiltrated secrets leaves the entry point open, as [DEV Community's analysis](https://dev.to/rbonweb/ghostaction-has-hit-github-repos-three-times-since-2025-and-it-never-actually-stopped-1mmg) explains.

The likely entry point is a stolen personal access token or credentials harvested by infostealer malware. Researchers label that as probable, not confirmed.

GitHub began blocking the malicious workflows from running on October 9, a step that limits secret theft in later waves, according to [OffSeq Radar](https://radar.offseq.com/threat/github-repos-compromised-b643825b4dc13c93). New waves using the same payload were still observed on October 10 and 12. Those waves could still push workflow files, but they could not extract secrets through the same path, per [CyberUpdates365](https://cyberupdates365.com/ghostaction-github-attack/).

A copycat is already visible. A phishing kit on a lookalike domain, documented October 11, takes a maintainer's password and one-time code, then authorizes an OAuth app with repo and workflow scopes, according to [OpenSourceMalware](https://opensourcemalware.com/blog/ghostaction-copycats-polinrider-by-hiding-a-stealer-in-a-fake-font-file). That grant gives an attacker the same workflow-write ability the original campaign relied on. Microsoft and Health-ISAC have also seized domains behind [YAM Store phishing kits](https://usa-24.com/yam-store-phishing-takedown/) in a separate case.

A separate npm supply-chain worm, ChainDrop/Shai-Hulud, compromised tensorlake version 0.5.144 on October 8, 2026. It harvests npm, GitHub, AWS and Kubernetes credentials along with AI tool configurations, per [daily.dev](https://daily.dev/posts/tensorlake-npm-sdk-compromised-in-chaindrop-shai-hulud-credential-stealing-attack-lxxzh37wl). The sources reviewed do not establish whether that worm, the phishing kit and GhostAction share operators. Likewise, USA 24's coverage of the [Meta GitHub breach](https://usa-24.com/meta-github-breach-stolen-credentials/) does not connect that incident to GhostAction in the sources reviewed.

## Practical steps to check and clean up your repositories

If your team uses GitHub Actions, work through these steps in order. The guidance comes from security researchers and vendor blogs, not from GitHub. The sources reviewed for this story include no GitHub-issued customer advisory and no CISA or FBI notice specific to GhostAction.

1. Search your repositories for disguised workflow files added since August 31, 2026, such as security-audit.yml and github_actions_security.yml. Assume compromise if you find one.
2. Delete the workflow from every branch, not only the default branch.
3. Audit workflow runs since August 31, 2026.
4. Revoke the compromised GitHub credential, not just the secrets it exposed.
5. Rotate every credential the workflow could reach, including keys that still appear in Git history.
6. Enforce phishing-resistant multifactor authentication and require review of workflow changes.
7. Tell anyone who cloned an infected repository, since opening it may have run the infostealer.

Exposed AWS, Google Cloud, npm, PyPI and AI provider keys remain usable until they are rotated. That is why the rotation step carries as much weight as deleting the file.

## What to watch next

Three open questions will shape the next few weeks. The account counts need reconciling, because GitGuardian's roughly 1,900 accounts and Socket's earlier 500-plus figure were measured differently, and the secret totals of 3,174 and 2,577 cover different windows. The initial access method also remains a probable explanation rather than a confirmed one.

Maintainers should expect more waves. Attackers have already reused old workflows, so a cleanup that stops at this week's repositories will leave older exposure in place. Watch whether GitHub publishes a formal incident post, whether it declares the blocking measure complete, and whether any US agency issues a GhostAction-specific advisory. The copycat phishing kit is the signal to watch for escalation, because it targets the one-time codes and OAuth grants that protect accounts after a password is stolen.

## Frequently asked questions

### How do I check if my GitHub repository is infected by GhostAction?

Search your repositories for disguised workflow files added since August 31, 2026, including security-audit.yml and github_actions_security.yml. If you find one, assume compromise, delete the workflow from every branch, and audit workflow runs since August 31. Then revoke the compromised credential and rotate every secret the workflow could reach.

### Is deleting the malicious workflow enough to stop GhostAction?

No. Researchers stress that the stolen access token is the persistent problem, and removing the workflow or rotating only exfiltrated secrets leaves the entry point open. Revoke the compromised GitHub credential and rotate every credential the workflow could reach, including those that still appear in Git history.

### How many GitHub accounts did GhostAction compromise?

GitGuardian reports about 1,900 compromised GitHub accounts and more than 30,000 targeted repositories. Socket's October 9 update reported more than 500 compromised maintainer accounts, a figure that reflects an earlier snapshot and a different counting window.

### Is GhostAction related to the Meta GitHub breach?

The sources reviewed for this story do not establish a link between GhostAction and the Meta GitHub breach. Treat them as separate incidents until more evidence appears.

### How is GhostAction different from the tj-actions attack?

The earlier tj-actions/changed-files incident poisoned a shared GitHub Action. GhostAction used stolen developer credentials to modify workflows directly in victims' own repositories without exploiting a flaw in GitHub Actions.

## Sources

1. [GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories](https://thehackernews.com/2026/10/ghostaction-compromises-about-1900.html)
2. [Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories](https://thehackernews.com/2026/10/credential-stealing-github-actions.html)
3. [GhostAction GitHub Attack Hits 1,900 Accounts](https://cyberupdates365.com/ghostaction-github-attack/)
4. [Hackers hijacked 1,900 GitHub accounts. Then they went after 30,000 repos.](https://daily.dev/posts/hackers-hijacked-1-900-github-accounts-then-they-went-after-30-000-repos--jyzqln0ak)
5. [GhostAction Returns: 500+ GitHub Accounts Compromised](https://breached.company/ghostaction-returns-malicious-github-actions-workflow-hits-500-accounts-tens/)
6. [GhostAction Attack Compromises 500+ GitHub Accounts to Steal Cloud and AI Credentials](https://cyberpress.org/ghostaction-attack-compromises-500-github-accounts/)
7. [GhostAction Returns: Malicious "Security Audit" Workflows Now Mine Credentials from Entire Git Histories](https://www.stepsecurity.io/blog/ghostaction-returns)
8. [The GhostAction Campaign: 3,325 Secrets Stolen Through Compromised GitHub Workflows](https://blog.gitguardian.com/ghostaction-campaign-3-325-secrets-stolen/)
9. [GhostAction Supply Chain Campaign Uses Malicious GitHub Actions to Steal CI/CD Credentials](https://cybersecuritynews.com/ghostaction-supply-chain-campaign/)
10. [GhostAction Returns: Fake Security Audit Workflow Steals Secrets From Tens of Thousands of GitHub Repositories](https://dev.to/etairos/ghostaction-returns-fake-security-audit-workflow-steals-secrets-from-tens-of-thousands-of-github-3ca8)
11. [GhostAction Has Hit GitHub Repos Three Times Since 2025, and It Never Actually Stopped](https://dev.to/rbonweb/ghostaction-has-hit-github-repos-three-times-since-2025-and-it-never-actually-stopped-1mmg)
12. [GhostAction Copycats PolinRider by Hiding a Stealer in a Fake Font File](https://opensourcemalware.com/blog/ghostaction-copycats-polinrider-by-hiding-a-stealer-in-a-fake-font-file)