The GhostAction GitHub attack does not exploit a bug in GitHub at all. Attackers steal a developer’s login credentials, push a workflow file that looks like a routine security audit, and let GitHub’s automation hand over the secrets. In the October 2026 wave alone, roughly 1,900 GitHub accounts were compromised and over 30,000 repositories targeted, per GitGuardian’s analysis of the October 8-9 spike. One leaked token can expose every repository its owner can write to — so if you maintain code on GitHub, run the checks below today.
What Is the GhostAction GitHub Attack?
GhostAction is a credential-theft campaign first discovered in September 2025. Attackers compromise developer GitHub accounts — likely with stolen Personal Access Tokens (PATs) or credentials from infostealer logs and leaked dumps — then push a malicious workflow into repositories the account can write to.
The file poses as legitimate security automation. Named “Security Audit” (security-audit.yml) or “GitHub Actions Security” (github_actions_security.yml), it sits in the standard .github/workflows/ directory, with boring commit messages by design: “Add security audit workflow” and “Update security audit workflow.”
There is no patch and no CVE, because no software flaw is involved. The fix is credential hygiene and workflow review, covered below.
How the October 2026 GhostAction GitHub Attack Worked
A new wave began on August 31, 2026. Then came the October burst:
- Account takeover. Attackers used stolen PATs or leaked credentials to take over maintainer accounts, some compromised months earlier and never rotated.
- Bulk injection. On October 8, 2026, two high-profile accounts were swept automatically: Takashi Kitao, author of the 18,400-star pyxel game engine (27 repositories), and Henry Wu (henrywoo), original author of Uber’s athenadriver project (318 repositories in 16 minutes). An Uber-owned repository was also hit via a contributor’s retained write access.
- Execution. When it ran, it collected the repository’s named GitHub Actions secrets and swept the working tree and full git history for more.
- Exfiltration. Everything found went to hard-coded IP 193.32.204.199 over plain HTTP; the server replied with a simple “OK.”
- Scale. As of October 9, Socket had identified over 500 GitHub accounts that committed the workflow to tens of thousands of repositories. GitGuardian’s later count: about 1,900 accounts, 30,000+ repositories, ~3,174 secrets extraction attempts.
GitHub began blocking the workflows from October 9, 2026 — but a block does not un-steal secrets from earlier runs, so repositories touched before it must still be treated as compromised.
What the GhostAction Workflow Steals
Earlier waves focused mainly on GitHub Actions secrets; the October 2026 version also harvests:
- GitHub Actions secrets stolen from CI/CD environments.
- Cloud credentials, such as AWS keys found in code or history.
- Package registry tokens for npm, PyPI, and DockerHub.
- AI provider API keys, including OpenAI, Anthropic, and OpenRouter keys.
- GitHub and GitLab tokens.
The most dangerous upgrade is the git history sweep. A key committed years ago, “removed” later, and long forgotten is still sitting in git history, readable by any workflow that checks out the full repository. That is why deleting an exposed secret is not enough: deletion from current files does not remove it from history. Rotation, not just deletion, is mandatory.
GhostAction: September 2025 Wave vs. October 2026 Wave
| Factor | September 2025 wave | October 2026 wave |
|---|---|---|
| Repositories affected | 817 across 327 users | 30,000+ across ~3,000 users/orgs |
| Accounts compromised | 327 users | ~1,900 accounts |
| Secrets targeted | 3,325 exfiltrated | ~3,174 extraction attempts from public repo CI |
| What it stole | CI/CD secrets, npm, PyPI, DockerHub tokens | Plus cloud, AI keys, git history secrets |
| Notable victims | Hundreds of smaller accounts | pyxel (18,400 stars), Uber’s athenadriver via a contributor |
| Response | Campaign documented and tracked | GitHub began blocking workflows from October 9, 2026 |
The pattern is clear: the same technique, at far greater scale, reaching deeper into each repository.
How to Check If Your Repo Is Affected
Treat any repository containing security-audit.yml or github_actions_security.yml since August 31, 2026 as compromised, per StepSecurity, Socket, and GitGuardian.
- Search every repository you own or contribute to for both filenames, across all branches, forks, and mirrors.
- Review recent commits for unexpected “Add security audit workflow” entries dated from August 31, 2026 onward.
- Inspect the Actions tab for runs of a “Security Audit” workflow; an executed run means secrets were within reach.
- Check your account’s security log for unfamiliar sign-ins, token use, or repository access.
- Scan git history for secrets with Gitleaks or TruffleHog to learn which credentials were ever committed.
- Audit tokens and apps: revoke any personal access token, OAuth app, or SSH key you do not recognize or use.
- Check downstream copies. If your repository was forked or mirrored, warn those maintainers.
If you find the workflow anywhere, assume exposure and move to cleanup: you cannot prove a specific secret was not taken.
Cleanup Order: Rotate Compromised Secrets on GitHub
- Revoke the compromised account access first. Change the password, revoke all active tokens and sessions, and re-authenticate.
- Remove the malicious workflow everywhere. Delete the file from all branches, forks you control, and mirrors.
- Revoke and rotate ALL potentially exposed credentials. Revoke each reachable secret at its provider and issue a new one — GitHub Actions secrets, AWS keys, npm/PyPI/DockerHub tokens, AI API keys, GitHub/GitLab tokens. Rotation means the old value stops working entirely; deleting a value from repository settings does not do that.
- Clean git history where secrets were committed. After rotation, consider rewriting history with git filter-repo or BFG Repo-Cleaner. Rewriting disrupts collaborators, so rotate first.
- Update dependent systems and monitor. Move pipelines and services to the new values, then watch cloud billing, registry logs, and AI usage for unfamiliar activity. Attackers sometimes wait before using stolen keys.
If your business website depends on affected repositories, professional help is worth it. Our team handles security reviews and site recovery through our services; reach us via our contact page.
How to Protect Your GitHub Account Going Forward
GhostAction succeeds because one stolen credential unlocks many repositories:
- GitHub personal access token security starts with fine-grained tokens. Scope fine-grained PATs to one repository with minimal permissions and short expiration dates.
- Enable two-factor authentication (2FA). Prefer an authenticator app or hardware key over SMS. 2FA will not stop a stolen PAT being used directly, but it reduces full account takeover.
- Turn on secret scanning and push protection. Scanning alerts you when a credential pattern lands in a repository; push protection blocks the push beforehand. Enable both everywhere.
- Audit tokens and collaborators regularly. Review tokens, SSH keys, and collaborators quarterly; remove access when a contributor’s work ends. The Uber case came through a contributor’s retained access.
- Require reviews for workflow changes. Use branch protection so changes to
.github/workflows/need review before merging. - Never commit secrets, even temporarily. Use environment variables or a secrets manager. Treat any secret that touches git history as permanently exposed.
These controls also guard against wider supply-chain attacks, including: the Rank Math Pro backdoor from October 2026 and AI agents being used to hack websites in 2026.
Frequently Asked Questions
Is there a patch for the GhostAction GitHub attack?
No. GhostAction is not a vulnerability in GitHub or GitHub Actions, so there is no patch or CVE. The fix: remove the workflow, revoke access, rotate every exposed credential.
How do I know if my repository was affected?
Search all branches and forks for either workflow filename, and review commits and Actions runs from August 31, 2026 onward. Treat any repository containing either file in that window as compromised.
Does deleting an exposed secret fix the problem?
No. Deleting a secret from current files does not remove it from git history, nor invalidate it at its provider. Revoke the old credential and issue a replacement; rotation is the only step that makes a stolen key useless.
Can private repositories be affected?
Yes. The campaign targets any repository the compromised account can write to, including private and organization repositories reached through contributor access. Private does not mean protected against a legitimate credential.
Conclusion
The GhostAction GitHub attack is a reminder that modern supply-chain attacks rarely break in through the front door. They walk in with a stolen key, disguised as a “security audit,” and let trusted automation steal. With 30,000+ repositories targeted in October 2026, this technique plainly works at scale.
The response is straightforward, if you act completely: find the workflow, revoke account access, remove the file everywhere, and rotate every credential it could have touched. Partial cleanup is the real risk — one unrotated key in an old commit can undo an otherwise thorough response. Run the checks above today, tighten your token scopes, and make workflow changes a reviewed event in every repository.
