THE GhostAction campaign has intensified, with attackers compromising around 1,900 GitHub accounts to target more than 30,000 repositories across some 3,000 users and organisations. The spike occurred on 8–9 October 2026, according to security researchers from GitGuardian. They reported that the operation aimed to extract 3,174 secrets from public CI pipelines, obtained via hijacked maintainer credentials used to push malicious GitHub Actions workflows into existing repositories.
Investigators note that the workflows were disguised under names such as Security Audit (security-audit[.]yml) and GitHub Actions Security (github_actions_security.yml).
The actors gained write access to repositories through stolen Personal Access Tokens or credentials harvested from infostealer logs and dumps. Once in, they used the compromised maintainer accounts to push malicious workflows, with the broader objective of exfiltrating CI/CD secrets, cloud credentials, registry tokens (for npm, PyPI and DockerHub) and API keys for AI providers.
A new wave observed from late August 2026 appears to have been more experimental and manual, with evolving payloads that added features such as secret-scanning of AWS keys and related context around hits. GitGuardian noted that while the initial wave affected 160 victims, a second phase targeted 28,000 new repositories on 8–9 October, with subsequent waves on 10 and 12 October largely blocked by GitHub from executing the malicious workflows. Some victims were previously compromised in earlier GhostAction waves, suggesting attackers rely on unrotated secrets.