GhostAction Targets GitHub Again as Operators Remain Active

A new wave of GhostAction attacks largely fizzled, but the operators behind the supply chain campaign remain active and adaptable. GhostAction targets GitHub by compromising developer accounts and injecting malicious GitHub Actions workflow files into repositories. By abusing the high level of trust placed in workflows, the attackers aim to exfiltrate credentials, access tokens and other secrets, with the intention of enabling broader access to CI/CD pipelines and cloud environments.

GitGuardian’s researchers reported an escalation in activity this month, including a large-scale push of malicious workflows across thousands of public repositories and continued attempts to leverage compromised accounts for further infiltration.

During the most recent wave, the threat actor deployed multiple payloads depending on the runner type, including a “seven workflows” variant that searches for credentials in GitHub runners and wikis, a “Security-audit.yml” for GitHub-hosted code and history, self-hosted runner payloads, a variant targeting GitHub runners with AWS OIDC token requests to seize cloud access, and a font-stealer payload disguised as a VS Code task.

The font stealer family is notable for its copycat provenance, linked to PolinRider, and while GitGuardian found a likely overlap with GhostAction, they observed no definitive evidence that any run occurred. GitHub reportedly identified and blocked execution of the malicious workflows, but researchers noted persistent access to about 1,800 compromised accounts, with many tokens already used previously.

Looking ahead, researchers warn that the campaign’s payloads show intent to pivot toward cloud and internal-network access, suggesting further waves with revised variants. In the meantime, GitHub users are advised to audit for the IoC indicators published by GitGuardian, revoke compromised tokens, and rotate credentials across affected repositories and histories.