GhostAction GitHub Attack: Stolen Logins Targeted More Than 30,000 Repositories for Cloud and AI Keys, What Is Confirmed and What to Check This Week

Attackers using stolen GitHub logins have been adding a fake "security" workflow to code repositories, and that workflow tries to send cloud keys, AI service keys and publishing tokens to a server they control. If your company or a developer you hire uses GitHub, check this week: GitGuardian says the operators are likely relying in part on old secrets that were never changed.

The campaign is called GhostAction. GitGuardian first documented it on September 5, 2025, reporting 3,325 secrets taken across 817 repositories and 327 users. The 2026 waves are far larger and reach further into a project's past.

What is the GhostAction GitHub attack?

GitHub Actions runs automated jobs, such as tests and deployments, whenever code changes. Those jobs often hold passwords and API keys, called secrets. GhostAction abuses that in three steps:

1. An attacker uses a stolen maintainer login to commit a workflow file with a harmless-sounding name, such as security-audit.yml or github_actions_security.yml.
2. The workflow runs on the next push and reads the secrets named in the project's other workflows.
3. It sends what it finds to the attacker's server in a single web request.

The October version adds something new. Socket found it also searches the current code and the full git history, using 13 patterns covering AWS, Anthropic, OpenAI, OpenRouter, GitHub, GitLab, Google and Firebase, Slack and SendGrid. A key deleted from the code years ago can still be found if it was never changed.

GhostAction timeline: what is confirmed

Socket's October 9 update counted more than 500 accounts, while GitGuardian's October 13 tally is about 1,900. They are separate counts taken at different times.

Runs did succeed before the block. Socket says the workflow ran successfully in affected repositories and calls kitao/pyxel, a project with 18,420 stars, the clearest confirmed case of publishing credentials being targeted. StepSecurity says the run log for uber/athenadriver shows the data was sent.

GitHub's block also did not cover everything. GitGuardian describes a later payload hidden in a fake font file that runs on a developer's own machine when they open the folder in VS Code and trust the workspace.

What is not known about GhostAction

• How the logins were stolen. Socket says it did not observe how. StepSecurity considers a leaked token from infostealer logs the likeliest route, but that is an inference.
• How many secrets reached the attackers. GitGuardian's 3,174 figure is what the attacker attempted to extract.
• Whether stolen keys have been used. As of October 9, Socket and StepSecurity had seen no malicious package releases. Neither report covers what happened afterward.
• Private repositories. The published counts describe public repositories, and GitGuardian calls its October 13 to 21 numbers lower bounds. We found no count for private repositories.

Why GhostAction matters for a company network or website

Stolen keys do not stay inside GitHub. An AWS key can open the cloud account behind your website. A SendGrid key can send email in your name. An AI key can run up charges. A publishing token can push a release to your customers.

Company code can also be reached through one person. Uber's repository was hit through the account of its original author, who has write access. GitHub's own documentation states that any user with write access to a repository has read access to all of its secrets, so every contractor and former developer still on your access list matters.

GhostAction checklist: what to do this week

Do not limit the search to new files. GitGuardian reports that in 92 cases during the August to September wave, the attacker modified a workflow left behind by an earlier wave instead of adding one, so our advice is to review changed workflows as well.

How to secure GitHub Actions after GhostAction

• Require pull requests on the default branch, and add .github/workflows to CODEOWNERS so a named reviewer must approve changes.
• Keep production secrets in GitHub environments with required reviewers. On the free plan, environments work only for public repositories.
• Replace long-lived cloud keys with OIDC where your provider supports it, and limit trust to specific repositories and branches.
• Turn on secret scanning push protection, which for repositories requires GitHub Secret Protection.
• Require approval for workflow runs from outside collaborators. StepSecurity saw runs on one project stall at an approval gate, so no data left.
• Use phishing-resistant MFA and remove write access nobody needs.

GhostAction questions people are asking

Is GhostAction still active?

GitGuardian's October 27 report records the last GhostAction commit on October 21. That does not prove the campaign is over, because the operator has returned before.

Did GitHub stop GhostAction?

Partly. GitHub began blocking the workflow on October 9, but earlier runs had already succeeded, and the font payload runs on developer machines.

Is deleting the workflow enough?

No. Revoke the GitHub credential that pushed it and change every exposed key, or the same access can be used again. GitGuardian saw re-infection where tokens were kept.

Were AI API keys stolen?

The payload searches for Anthropic, OpenAI and OpenRouter keys. The reports do not say how many were taken.

Does restricting GitHub Actions permissions stop it?

Not on its own. Setting GITHUB_TOKEN to read-only is good practice, but it does not stop someone holding a stolen login with write access from reading your secrets. Review requirements and approval gates do more here.

The bigger lesson

A leaked key stays dangerous until someone changes it. GhostAction works because old tokens, old commits and old access lists are rarely cleaned up, and the attacker only needs one that still works. Short-lived credentials, reviewed workflow changes and a regular access review take that advantage away.

For help reviewing your repositories, keys and servers, see security hardening or request a quote.

Get security alerts like this by email, with the free checklist, at our security alerts page.

Sources: Socket; GitGuardian, GhostAction returns; GitGuardian, October escalation; GitGuardian, 2025 campaign; StepSecurity; GitHub secure use reference; GitHub environments; GitHub push protection.