A fresh wave of the GhostAction supply-chain campaign has compromised more than 500 GitHub accounts, using them to plant a disguised malicious workflow across tens of thousands of repositories. Despite being named to look like a routine security check, the file’s real job is to quietly harvest cloud, AI, and publishing credentials and exfiltrate them in plain text.

Security firm Socket, which tracked the campaign, reports that compromised accounts began adding the malicious file on October 7, 2026. Some of the affected repositories belong to major organizations, illustrating how a single hijacked maintainer account can expose far more than just that individual’s own projects.

How the Attack Unfolded

Socket zeroed in on a particularly intense burst of activity on October 8, 2026. Two compromised accounts — identified as “henrywoo” and “kitao” — pushed a file named security-audit.yml into 346 repositories combined, using innocuous-sounding commit messages like “Add security audit workflow.” In reality, the file performs no legitimate auditing. Instead, it harvests secrets from the repository and sends them unencrypted to a single external IP address.

Among the affected repositories were uber/athenadriver, owned by Uber, and kitao/pyxel, a popular Python game engine with more than 18,000 GitHub stars. The henrywoo account had legitimate write access to the Uber repository as its original author — a reminder that the blast radius of a compromised account extends to every repository that account can touch, not just ones the person personally owns.

The operational tempo points strongly toward automation rather than manual effort: the henrywoo-account changes were pushed across repositories within roughly a 16-minute window, while the kitao-account changes landed in just four minutes. Notably, even long-dormant repositories that hadn’t seen activity in a decade received the malicious file, suggesting the attackers’ tooling targeted every repository an account could write to, indiscriminately.

A More Aggressive Evolution of GhostAction

This isn’t GhostAction’s first appearance. An earlier wave of the campaign, previously reported, hit roughly 772 repositories and exploited the same underlying weakness in how GitHub Actions workflows handle secrets. That earlier version, and a related campaign first documented by GitGuardian in September 2025 that compromised 327 users and stole 3,325 secrets across 817 repositories, limited themselves to secrets actively referenced inside GitHub Actions configurations.

The new wave goes further. It retains that original technique but adds a deeper search through repository files and the complete git commit history. That distinction matters significantly for affected developers: many assume that deleting a leaked key from the current version of a file resolves the exposure, but the credential often remains recoverable from an old commit. The malicious workflow specifically sets fetch-depth: 0, a configuration option that pulls the entire branch and tag history of a repository, giving the script access to the project’s full historical record rather than just its current state.

What the Malicious Workflow Actually Steals

According to Socket’s technical breakdown, the script searches for roughly 13 distinct categories of secrets, including:

• AWS access keys and temporary session tokens
• API keys for OpenAI, Anthropic, and OpenRouter
• GitHub and GitLab authentication tokens
• Google Cloud and Firebase credentials
• Slack tokens and other publishing or messaging credentials

The breadth of that target list — spanning cloud infrastructure providers, AI platforms, and collaboration tools — reflects how central these kinds of API keys have become to modern development workflows, and how valuable they are to attackers looking to pivot into cloud infrastructure, run up compute bills on stolen AI credits, or gain further access to connected systems.

How Developers and Organizations Should Respond

Socket’s research did not determine exactly how the initial maintainer account credentials were compromised, which itself is a useful reminder that credential theft can originate from phishing, malware, password reuse, or leaked session tokens well before a GitHub-specific attack even begins. Organizations maintaining public repositories should audit recent workflow file changes for unfamiliar or recently added automation, rotate any credentials that may have ever been committed to a repository — even ones since deleted — and enable mandatory multi-factor authentication and strict branch protection rules for maintainer accounts with write access to high-value projects.