The supply chain campaign GitGuardian calls GhostAction came back harder this month. On October 8 and 9, 2026, intruders seized control of roughly 1,900 GitHub accounts and reached more than 30,000 repositories, targeting over 3,000 users and organizations.
Using stolen personal access tokens and credentials lifted from infostealer logs, the operators planted GitHub Actions workflow files named to look routine, such as security-audit.yml and github_actions_security.yml. Once triggered, those workflows scrape CI secrets, cloud keys, package registry tokens, and AI provider API keys.
A payload that learned to hunt
GitGuardian traced three iterations of the payload. The first added history scanning with regexes tuned for AWS key IDs, GitHub and GitLab tokens, and cloud API keys. A later build captured surrounding lines to pair an AWS key ID with its matching secret. The last version pulled that context during the scan itself.
The rollout was staged aggressively: an initial push to 160 prior victims, then 28,000 new repositories roughly twenty minutes later. Further waves followed on October 10 and 12.
Only the first wave paid out
GitHub began blocking the malicious workflow on October 9, so the two follow-up pushes extracted nothing. That cutoff is the difference between a contained incident and one of the larger CI credential exposures of the year.
Some of the hijacked accounts had already been hit in the September 2025 and August 2026 rounds. The operators were counting on secrets nobody had rotated, and in at least part of this wave that bet paid off.
Audit workflow files for unfamiliar entries, rotate every token a compromised repository could reach, and assume anything committed to git history stays exposed.
