Audit GitHub Actions Secrets After GhostAction Campaign Compromises 500 Accounts

A cybercriminal group known as GhostAction has compromised more than 500 GitHub accounts since October 7, 2026, to steal sensitive credentials. According to a report by GBHackers, the attackers injected malicious workflows into tens of thousands of repositories, creating a widespread risk for developers who rely on these platforms for software management.

Socket released an update on October 9, 2026, detailing how the operation specifically targets GitHub Actions secrets. The attackers aim to harvest cloud credentials and artificial intelligence service API keys that are often embedded directly in source code or hidden within repository history. This method allows them to access valuable digital assets without needing direct login access to the primary accounts.

How the Attack Works

The GhostAction campaign relies on injecting malicious code into the automated processes that developers use to build and test software. By compromising accounts, attackers gain the ability to modify these workflows. Once the malicious workflow is in place, it runs automatically when code changes are pushed, silently exfiltrating any secrets or keys it encounters in the repository environment.

This technique is particularly dangerous because it hides within normal development activities. Developers may not notice the intrusion until their cloud services or AI tools have already been accessed by unauthorized parties. The scale of the injection, affecting tens of thousands of repositories, suggests a highly automated and persistent threat actor.

Who Is Affected

Small business owners and independent developers are among those potentially affected by this breach. Any organization using GitHub Actions for continuous integration or deployment faces risk if their repositories contain sensitive keys. The attack does not discriminate based on company size, but smaller teams may lack the security resources to detect such subtle workflow modifications quickly.

According to GBHackers, the campaign has expanded significantly since its start in early October 2026. The sheer volume of compromised accounts and injected workflows indicates that many organizations may not yet realize they have been targeted. Developers who have collaborated with others or used public repositories are especially vulnerable to this type of supply chain attack.

What to watch

Security researchers are monitoring the situation for new tactics from the GhostAction group. Since the initial discovery in October 2026, the campaign has grown, suggesting the attackers are actively seeking more targets. Organizations should watch for unusual activity in their GitHub Actions logs, such as unexpected workflow runs or new secrets being added to their repositories.

There is no confirmed fix or patch for this specific campaign at this time. The threat persists as long as the compromised accounts remain active and the malicious workflows are not removed. Developers must assume that any repository involved in this timeframe could be compromised until proven otherwise through thorough manual inspection.

What to do and how to stay safe: GitHub

• Review all GitHub Actions workflows in your repositories for unauthorized changes or unfamiliar steps added since October 2026.
• Rotate any cloud credentials or AI service API keys that may have been stored in repository history or exposed in logs.
• Audit access permissions for all GitHub accounts to ensure only authorized team members have administrative rights.
• Monitor cloud service logs for unusual activity that could indicate the use of stolen credentials by attackers.

Step-by-step guide: Multi-Factor Authentication Setup for Small Teams

General security guidance from the Shell Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How many accounts have been compromised in the GhostAction campaign?

More than 500 GitHub accounts have been compromised since the campaign began on October 7, 2026.

What are the attackers trying to steal?

The attackers are targeting GitHub Actions secrets, cloud credentials, and AI service API keys embedded in source code.

When did this campaign start?

The GhostAction campaign began injecting malicious workflows into repositories on October 7, 2026.