New Delhi: Cybersecurity researchers have disclosed details of an ongoing credential-theft campaign that compromised two high-profile open-source maintainer accounts to push a malicious workflow into more than 340 repositories — part of a wider supply-chain attack campaign dubbed GhostAction.
According to StepSecurity, the attacker used the account of Takashi Kitao, author of the 18,400-star game engine pyxel, to push the workflow to 27 repositories from 13:20 UTC. Eight hours later, Henry Wu's account — original author of Uber's athenadriver — pushed it to 318 repositories in 16 minutes. As of October 9, Socket said more than 500 GitHub accounts had committed the malicious workflow to tens of thousands of repositories since October 7.
How the theft works
Both accounts pushed a workflow named Security Audit (security-audit.yml) or GitHub Actions Security (github_actions_security.yml), designed to exfiltrate sensitive data to a hard-coded IP address over plain HTTP. The captured data includes the repository's named GitHub Actions secrets — CI/CD secrets plus cloud, AI and SaaS credentials found in the working tree and the entire git history, such as AWS keys, Anthropic, OpenAI and OpenRouter API keys, and GitHub and GitLab tokens.
Researchers believe the attacker obtained the maintainers' GitHub credentials through leaked personal access tokens harvested from infostealer logs or credential dumps. The workflow masquerades as a security audit, scans workflow files for secrets, then injects itself into the default branch under the victim's own identity.
A campaign with history
GhostAction first came to light in September 2025, when it hit 817 repositories across 327 GitHub users and exfiltrated 3,325 secrets, including PyPI, npm and DockerHub tokens. GitGuardian separately reported that between August 31 and September 30, 2026, the campaign pushed the malicious workflow to 772 public repositories belonging to 373 GitHub users and organisations, targeting 2,577 secrets ranging from SSH private keys to Slack and Discord bot tokens.
In at least one case observed on August 30, the attackers altered the "kuafuai/DevOpsGPT" repository to embed an XMRig cryptocurrency miner in its Docker image. As of now, researchers say no malicious package releases have been published using the compromised credentials.
What developers should do
Researchers advise developers to check their repositories for either of the two workflow files since August 31, 2026, and assume compromise if present: revoke the compromised credential, rotate all credentials, delete the malicious workflow from every branch, and check forks. Socket warned that the 279 forks in the henrywoo namespace each carry the workflow file — and that private forks and downstream mirrors are the most exposed, since private repositories are where committed credentials actually get found.
Sources:
- The Hacker News: Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories
According to StepSecurity, the attacker used the account of Takashi Kitao, author of the 18,400-star game engine pyxel, to push the workflow to 27 repositories from 13:20 UTC. Eight hours later, Henry Wu's account — original author of Uber's athenadriver — pushed it to 318 repositories in 16 minutes. As of October 9, Socket said more than 500 GitHub accounts had committed the malicious workflow to tens of thousands of repositories since October 7.
How the theft works
Both accounts pushed a workflow named Security Audit (security-audit.yml) or GitHub Actions Security (github_actions_security.yml), designed to exfiltrate sensitive data to a hard-coded IP address over plain HTTP. The captured data includes the repository's named GitHub Actions secrets — CI/CD secrets plus cloud, AI and SaaS credentials found in the working tree and the entire git history, such as AWS keys, Anthropic, OpenAI and OpenRouter API keys, and GitHub and GitLab tokens.
Researchers believe the attacker obtained the maintainers' GitHub credentials through leaked personal access tokens harvested from infostealer logs or credential dumps. The workflow masquerades as a security audit, scans workflow files for secrets, then injects itself into the default branch under the victim's own identity.
A campaign with history
GhostAction first came to light in September 2025, when it hit 817 repositories across 327 GitHub users and exfiltrated 3,325 secrets, including PyPI, npm and DockerHub tokens. GitGuardian separately reported that between August 31 and September 30, 2026, the campaign pushed the malicious workflow to 772 public repositories belonging to 373 GitHub users and organisations, targeting 2,577 secrets ranging from SSH private keys to Slack and Discord bot tokens.
In at least one case observed on August 30, the attackers altered the "kuafuai/DevOpsGPT" repository to embed an XMRig cryptocurrency miner in its Docker image. As of now, researchers say no malicious package releases have been published using the compromised credentials.
What developers should do
Researchers advise developers to check their repositories for either of the two workflow files since August 31, 2026, and assume compromise if present: revoke the compromised credential, rotate all credentials, delete the malicious workflow from every branch, and check forks. Socket warned that the 279 forks in the henrywoo namespace each carry the workflow file — and that private forks and downstream mirrors are the most exposed, since private repositories are where committed credentials actually get found.
Sources:
- The Hacker News: Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories
