GhostAction returns: the security audit that steals your secrets
GhostAction is back: hijacked maintainer accounts plant “security-audit.yml” workflows that ship your CI secrets out
Compromised GitHub accounts pushed workflows dressed up as security jobs that exfiltrate Actions secrets. A new variant scans full git history, so the key you deleted three years ago still counts. GitHub started blocking the workflow on Oct 9.
- Disclosed
- Oct 9, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- ~1,900 accounts and 30,000+ repos targeted (GitGuardian); 3,174 secrets attempted
- github-actions
- In the wild
- Yes
- Thousands of secrets exfiltrated before GitHub's block
The one-sentence version
A stolen maintainer token pushes a “security audit” workflow; it runs on push, dumps every secret and every credential-looking string in your git history, and POSTs them to the attacker.
What happened
GhostAction first hit in 2025. This wave started quietly on August 31, 2026 and exploded on
October 8. The attackers log in as real maintainers, probably with leaked personal access tokens
(unconfirmed), and push a workflow with a reassuring name like security-audit.yml.
The workflow reads named Actions secrets and greps for 13 credential patterns: AWS, Anthropic, OpenAI,
OpenRouter, GitHub and GitLab tokens, GCP, Slack, SendGrid. A newer variant checks out with
fetch-depth: 0 and runs git log -p --all. Anything that was ever committed is in scope, even if you
removed it years ago. Results go by HTTP POST to 193.32.204[.]199.
How big?
The counts disagree, so here they all are:
| Who | Says |
|---|---|
| GitGuardian | ~1,900 accounts, 30,000+ repos targeted, 3,174 secrets attempted |
| Socket | 500+ accounts, “tens of thousands” of repos. Its detailed count is 346 repos from 2 accounts |
| StepSecurity | 378 repos still carried the workflow on Oct 9 |
Some victims were repeats from earlier waves. They had never rotated the secrets stolen last time. GitHub began blocking the workflow on October 9, and later waves on October 10 and 12 came away empty.
Crime-scene timeline
Aug 31, 2026
New wave first observed by GitGuardian
StepSecurity sees the exfiltration endpoint in use from Sep 4–5.
Oct 8, 2026
Mass sweeps
The kitao and henrywoo accounts push the workflow to 345 repos. GitGuardian counts ~28,000 repos targeted over Oct 8–9.
Oct 9, 2026
GitHub starts blocking the workflow; Socket and StepSecurity publish
Oct 10 & 12, 2026
Further waves fail to extract secrets
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- SocketPrimaryTracks activity from Oct 7; claims 500+ accounts and tens of thousands of repos, detailed count 346 repos from 2 accounts
- StepSecurityPrimary378 repos still had the workflow on the default branch on Oct 9; suspects PATs from infostealer logs (unconfirmed)
- The Hacker NewsGitGuardian numbers, ~1,900 accounts, 30,000+ repos, 3,174 secrets
- The New StackSame GitGuardian figures