GhostAction Hack Compromises GitHub Developer Accounts
Malicious actors operating the GhostAction campaign successfully compromised two GitHub developer accounts. Within mere hours, they stealthily injected malicious scripts into a staggering minimum of 345 repositories. These insidious scripts systematically pilfered tokens and cryptographic keys directly from GitHub Actions. Furthermore, the latest iteration of this malware meticulously scoured the entire project history. Consequently, even long-deleted credentials previously scrubbed from the active codebase were devastatingly compromised.
The Anatomy of the October Assault
This sophisticated offensive materialized in two rapid waves on October 8. Initially, the assailants hijacked the account of developer Takashi Kitao, injecting a malicious payload into 27 distinct repositories. Approximately eight hours later, utilizing the compromised account of Henry Wu, they deployed the identical script across 318 additional projects. Remarkably, this massive second wave concluded in a mere 16 minutes.
The attackers bypassed the standard protocol of initiating pull requests and awaiting peer code reviews. By exploiting authentic developer accounts, they committed their malicious alterations directly into the primary branches. For instance, Henry Wu’s pre-existing elevated privileges facilitated the seamless integration of the malicious file into the uber/athenadriver repository under the guise of a legitimate contributor.
Extracting Secrets and Historical Data
The malicious script cleverly adopted the innocuous moniker “security-audit.yml,” masquerading as a routine security verification process. Upon execution, it aggressively harvested GitHub Actions secrets, encompassing tokens, API keys, and essential credentials utilized by automated tasks for external service authentication. Subsequently, the program downloaded the comprehensive Git history, relentlessly hunting for residual keys buried within legacy commits, branches, and tags.
This exhaustive historical search exponentially amplifies the potential devastation. If a developer inadvertently committed an API key and subsequently deleted it in the next revision, that sensitive string likely persisted within the Git history. GhostAction is specifically engineered to unearth these exact digital footprints. The exhaustive target list included AWS keys, GitHub and GitLab tokens, Google and Firebase credentials, Slack and SendGrid tokens, and invaluable API keys for Anthropic, OpenAI, and OpenRouter.
The script transmitted the exfiltrated intelligence via a standard HTTP request to the IP address 193.32.204.199. The execution log for uber/athenadriver definitively confirmed that the attacker’s server successfully received the payload merely four seconds post-execution. While the transmission itself does not quantify the precise number of viable keys extracted from a specific repository, it unequivocally verifies the successful deployment of the malicious code.
Within the pyxel project, the script executed five distinct times. Three executions were triggered by commits dispatched by the assailant via the hijacked account, while the remaining two were initiated manually. The targeted assets included credentials required for publishing packages to PyPI and crates.io, alongside personal GitHub tokens. At the time of this analysis, researchers from GitGuardian had not detected any malicious package releases published utilizing these stolen keys.
The Expanding Scale of GhostAction
By October 9, GitHub search queries identified the malicious script firmly entrenched within the primary branches of 378 repositories. However, this metric significantly underestimates the true magnitude of the campaign. The search parameters fail to account for numerous project forks, and administrators of infected repositories are actively purging the malicious files. Consequently, researchers continue to diligently refine the total casualty count.
GhostAction is a persistent threat, operating for years as a classic supply chain attack. In these scenarios, compromising a developer grants direct access to the source code, critical build infrastructure, and sensitive project credentials. During September 2025, StepSecurity researchers documented that perpetrators infiltrated 817 repositories, exfiltrating a minimum of 3,325 secrets. This renewed malicious activity extends beyond the October surge. Between August 31 and September 30, 2026, analysts discovered 772 repositories infected with an earlier iteration of the malicious script.
The precise methodology employed by the assailants to initially seize control of these developer accounts remains unverified. Researchers theorize the utilization of previously purloined access tokens or compromised credentials harvested from extensive databases compiled by password-stealing malware. However, concrete forensic evidence delineating the specific intrusion vector for this current wave remains elusive.
Administrators of affected projects are strongly advised to meticulously eradicate the malicious scripts from all branches, rigorously audit the GitHub Actions execution history, and immediately revoke any credentials that facilitated the initial unauthorized access. Merely rotating current active secrets is no longer a sufficient remediation strategy. If a critical key ever existed within the repository’s historical record, it must be considered definitively compromised and replaced immediately.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
