Audit GitHub Actions Workflows After GhostAction Injects Malicious Security Scripts
Attackers compromised developer accounts to inject credential-stealing workflows into hundreds of repositories, targeting stored secrets and historical code data.
Key points
- GhostAction injected malicious workflows into 790 GitHub repositories by October 9, 2026, according to GBHackers.
- The attack leverages compromised maintainer accounts to push code directly to default branches without review.
- Malicious scripts search repository history for credentials, exposing secrets deleted from current files.
Attackers gained access to sensitive credentials and historical code data by exploiting compromised developer accounts on GitHub. The GhostAction threat group injected malicious workflows into 790 repositories by October 9, 2026, according to GBHackers. This operation allows attackers to automatically collect secrets available to the platform’s automation tools. The breach highlights how a single compromised account can expose numerous connected projects and their associated cloud infrastructure.
The campaign targets the automation layer of software development, specifically GitHub Actions. Attackers push a file named security-audit.yml that triggers on code pushes or manual execution. This script searches the working tree and reachable Git history for credential patterns, capturing surrounding context. It sends collected data over unencrypted HTTP to an external server, exposing AWS key identifiers and other secrets. The method exploits the trust placed in automated security tools within development environments.
Campaign Scope and Methods
This operation builds on account-takeover techniques first documented by GitGuardian in 2025. That earlier report identified 817 affected repositories and 3,325 stolen secrets. The current wave uses the same approach but broadens credential collection methods. Attackers enumerate repositories a compromised maintainer can write to and push workflows directly to default branches. This bypasses standard review processes like pull requests, allowing malicious code to run immediately in trusted environments.
Targets and Vulnerable Accounts
Socket and StepSecurity documented two automated injection bursts on October 8, 2026. The first involved 27 repositories linked to the compromised kitao account. The second involved 318 repositories associated with henrywoo, including Uber’s uber/athenadriver project. In that case, the workflow was pushed directly to the master branch under the maintainer’s identity. OpenSourceMalware validated a total of 790 affected repositories, including many forks and long-dormant projects, suggesting automated enumeration rather than targeted selection.
What to watch
Small-business owners should monitor for unexpected workflow executions or new security-themed files in their repositories. Check for direct pushes to default branches that bypass pull request reviews. Watch for credentials being accessed from historical code commits, as attackers now search Git history. Monitor for unencrypted HTTP traffic originating from your CI/CD pipelines, which may indicate exfiltration. Review account activity logs for signs of unauthorized access or enumeration attempts by external actors.
What made it possible
Teams usually rely on trusted maintainer accounts to manage repository access and automation rules. This incident exploits the privilege of write access to default branches. When an account is compromised, attackers can inject code that runs with elevated permissions. The weakness lies in assuming that workflow files are inherently safe or reviewed. Without mandatory pull request reviews for automation updates, malicious scripts can execute immediately. This stage of an intrusion serves to establish persistence and steal credentials without triggering immediate alerts.
What to do and how to stay safe: GhostAction
- Review all recent workflow files in your repositories for unauthorized changes or new security-audit scripts.
- Enforce mandatory pull request reviews for all changes to default branches, including automation configurations.
- Rotate any credentials or secrets that may have been exposed through compromised accounts or historical code.
- Enable two-factor authentication on all developer accounts to prevent unauthorized access and credential theft.
Step-by-step guide: Multi-Factor Authentication Setup for Small Teams
General security guidance from the Shell Bulletin newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How did the attackers gain access to the repositories?
Attackers compromised developer maintainer accounts and used their write permissions to inject malicious workflows directly into repositories.
What specific data did the malicious workflows collect?
The scripts searched repository history and current files for credential patterns, including AWS key identifiers, and sent them over unencrypted HTTP.
Which major project was confirmed to be affected?
Uber’s uber/athenadriver repository was among the affected projects, with a malicious workflow pushed directly to the master branch.
