Key points
- repositories were affected by October 2026.
- Attackers pushed workflows directly to branches without review.
- Scripts searched Git history for deleted credentials.
The GhostAction campaign has injected malicious workflows into 790 GitHub repositories by 9 October 2026, according to GBHackers. Attackers gained access by compromising developer accounts, then used those privileges to push fake security scripts. These scripts run automatically, collecting secrets from the repositories and sending them to external servers.
In plain English
The attackers did not break into the repository code itself. Instead, they stole the login details of maintainers who had permission to write to the projects. Once inside, they added new automation files that looked like legitimate security checks. When the repository updated, these hidden files ran and searched for sensitive data.
The background
GitGuardian first identified GhostAction in 2025, reporting 817 affected repositories and 3,325 stolen secrets at that time. The latest wave uses the same method but targets more projects. Socket and StepSecurity documented two major injection bursts on 8 October. One burst hit 27 repositories linked to the kitao account. The second hit 318 repositories linked to henrywoo, including Uber’s athenadriver project.
What changes now
The October variant of the attack is broader than previous versions. The malicious workflow, named security-audit.yml, checks out the full repository history. It searches for credential patterns in both current files and older commits. This allows attackers to find secrets that were deleted long ago. The stolen data is sent over unencrypted HTTP to a server at 193.32.204[.]199.
The attacker's path
Teams usually face this risk when a single compromised account has broad write access to many repositories. The weakness lies in trusting automated workflows from trusted users without verifying their content. This stage of an intrusion serves to establish persistence and exfiltrate data silently. Check whether recent workflow changes were manually reviewed. Verify that no unauthorised scripts run on push events. Ensure that secrets are not stored in Git history.
What to do and how to stay safe: GhostAction
- Audit recent workflow files in repositories for unauthorised additions, especially those pushed directly to main branches without pull requests.
- Rotate all secrets and credentials that were accessible to the compromised accounts, as they may have been exfiltrated via the malicious scripts.
- Review Git history for any sensitive data that may have been committed and subsequently deleted, as the attack tool searches for these remnants.
- Monitor network logs for outbound HTTP traffic to unknown IP addresses, particularly those associated with credential exfiltration endpoints.
Step-by-step guide: Phishing vs Spam: How to Tell the Difference and Stop Threats
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many repositories were affected by the latest GhostAction wave?
By 9 October 2026, 790 repositories were affected, according to GBHackers.
Did the attackers use pull requests to inject the malware?
No, in cases like Uber’s athenadriver, the workflow was pushed directly to the master branch without a pull request or review.
What kind of data did the malicious workflow steal?
The script searched for credential patterns in the working tree and Git history, including AWS key identifiers and surrounding context.
