Hackers Compromise 1900 GitHub Accounts and Target 30000 Repositories

Attackers linked to the GhostAction campaign infiltrated approximately 1900 GitHub accounts and deployed malicious GitHub Actions workflows in over 30000 repositories. The attackers sought to steal CI/CD tokens, cloud access keys, and AI provider API keys. Activity peaked on October 8 and 9. Researchers recorded 3174 secret extractions during the campaign. Unlike known GitHub Actions vulnerabilities, the threat actors used stolen developer credentials to modify workflows directly. Analysts from StepSecurity suggest the initial access vector may involve leaked personal access tokens, though the exact method remains unconfirmed. After gaining repository access, the attackers masked malicious jobs as routine security checks, naming files security-audit.yml or github_actions_security.yml. Because these files referenced legitimate repository secrets, the malicious processes harvested credentials during execution and transmitted them to a command-and-control server.

A deeper October iteration expanded the scope beyond explicitly listed secrets. The attackers used the actions/checkout@v4 action with fetch-depth: 0 to perform a full repository clone and history scan. Targeted artifacts included AWS credentials, GitHub and GitLab personal access tokens, Google and Firebase service keys, and AI provider API tokens such as Anthropic, OpenAI, and OpenRouter. All harvested credentials were exfiltrated via HTTP to the IP address 193.32.204.199. Notably, even keys that had been removed from current codebases remained accessible in Git history and were harvested. The operation unfolded in stages: initial malicious code delivery to 160 known victims, followed by mass propagation to 28000 additional repositories within 20 minutes. Exact data loss figures are unavailable, but GitGuardian documented leaks throughout October. Earlier August and September campaigns yielded 772 public repositories with 336 successful runs that stole 26 secrets from 13 repositories.