A new wave of the GhostAction campaign has compromised more than 500 GitHub accounts. The attackers used those accounts to plant a fake security workflow across tens of thousands of repositories, and the workflow steals cloud, AI, and publishing credentials.
Malicious workflow planted across repositories
Security firm Socket says the affected accounts began adding the malicious file on October 7, 2026. Some of the repositories belong to large organizations. On October 8, 2026, Socket studied a burst in which two hijacked accounts, henrywoo and kitao, pushed a file called security-audit.yml into 346 repositories.
The commit messages said “Add security audit workflow” and “Update security audit workflow.” The file does no security work. It collects secrets and sends them in plain text to the IP address 193.32.204[.]199. The list of targets includes uber/athenadriver, which is owned by Uber, and kitao/pyxel, a Python game engine with more than 18,000 stars.
Why the account takeover matters
The henrywoo account has write access to the Uber project because he is its original author. Socket says this shows how costly one stolen maintainer account can be. The damage reaches every repository the account can edit, not only the owner’s own projects.
The attackers first obtain a working login for a maintainer account. Socket did not see how they did this. They then scan each repository for the secret names already used in workflows and write those names into the fake file. After that, they commit the file straight to the default branch, where it runs on the next push.
The same file appeared in hundreds of repositories within minutes, so Socket believes a tool carried out the work rather than a person. The henrywoo changes landed in about 16 minutes, while the kitao changes landed in a four-minute window. Even repositories that had sat idle for a decade received the file.
How the theft reaches old history
The new version of GhostAction keeps the earlier secret-stealing trick and adds a search through repository files and full git history. Earlier waves only took secrets stored in GitHub Actions. GitGuardian first described that approach in September 2025, when 327 users and 817 repositories lost 3,325 secrets.
This matters because many developers delete a key from the latest file and assume the issue is gone. The old commit can still contain the key. The workflow uses fetch-depth: 0, which pulls every branch and tag so the script can read the full history of the project.
The script looks for 13 kinds of keys. These include AWS access keys and session tokens, OpenAI, Anthropic, and OpenRouter API keys, GitHub and GitLab tokens, Google and Firebase keys, Slack tokens, and SendGrid keys. One detail points to the AWS focus: an AWS key ID by itself cannot log in to anything, and the secret half usually sits a line or two away in an .env file or a Terraform file. The script copies two lines above and below each key ID so the attacker can rebuild a full AWS key pair.
Publishing tokens and package risk
Publishing tokens are also exposed. For Pyxel, the named secrets were tokens for PyPI and crates.io, along with a GitHub personal access token. With those tokens, an attacker could push a malicious update to a package that many people trust.
As of October 9, 2026, the file was still on the default branch of the repositories Socket checked. The workflow had also run successfully, so data could already have left. Socket saw no bad package versions on PyPI or crates.io at the time of writing, but that does not prove the stolen keys were unused.
Forks, growth, and related reporting
Forks increase the exposure. Socket counted 279 forks under the henrywoo name that carry the file, and Actions can run it on later pushes if they are enabled. Machine learning projects such as henrywoo/pyllama and henrywoo/chatllama stand out because their users often hold AWS and AI keys.
The campaign has continued to expand. OpenSourceMalware counted 790 repositories with the workflow through October 9, 2026, which our team covered in a report on 790 hijacked GitHub repositories. AI tools can make exposed keys more dangerous. Microsoft says attackers used an AI framework called ARTEX to find GitHub secrets and reach Azure Key Vault in about five minutes, as shown in our ARTEX AI report.
What to check and revoke
Start by opening .github/workflows/security-audit.yml and checking which secret names it lists. Rotate every secret named there. For a GitHub personal access token, revoke it and create a new one. Review the Actions run history and treat every finished run as a successful theft.
Next, scan the full git history with git log -p --all and rotate every key you find, even if it no longer appears in the current files. For AWS keys, check CloudTrail for new IAM users, new access keys, and use in unusual regions. Treat the maintainer account as fully compromised, revoke all sessions, tokens, OAuth grants, and SSH keys, turn on phishing-resistant multi-factor login, and search the organization audit log for new workflow files. Block 193.32.204[.]199 in egress logs, including self-hosted runners, and turn on GitHub secret scanning with push protection while requiring approval for workflow runs from outside contributors.
Licensed under CC BY-ND 4.0 International