GhostAction Returns: 2,577 CI/CD Secrets Stolen in GitHub Actions Wave
Reach 50,000+ security professionals
Sponsor a newsletter slot and put your brand in front of CISOs, engineers, and IT decision-makers.
GhostAction compromised 373 GitHub maintainer accounts and injected malicious CI/CD workflow files across 772 repositories between August 31 and September 30, 2026, targeting 2,577 secrets including Anthropic and OpenAI API keys. As of October 2026, 378 repositories still carry the live malicious workflow with active exfiltration potential on the next developer push.
The attack is a supply chain campaign that weaponizes GitHub's own Actions automation framework. Attackers compromise a maintainer account, then add a malicious YAML file to the .github/workflows/ directory of every repository that account can modify. Three workflow variants have been confirmed: github_actions_security.yml, security-check.yml, and a 2026-era security-audit.yml that also mines full git commit history for credentials removed in previous rotation cycles. Each file masquerades as a routine security scan. When any developer triggers the workflow with a normal push, the malicious steps read GitHub Actions secrets from the runner environment and send them via curl POST to a C2 server at 193.32.204.199 over plain HTTP.
The practical risk to your organization is direct: pipeline secrets give attackers the same access as a senior engineer performing a production deployment. AWS root credentials, GitHub personal access tokens, and database passwords stored in GitHub Actions are all in scope. The 2026 resurgence also confirms that AI inference API keys are now valued targets, with the threat actor specifically collecting credentials for Anthropic, OpenAI, and OpenRouter -- credentials that carry real financial cost per token when abused at scale.
Audit your .github/workflows/ directories now. Rotate every secret stored in GitHub Actions regardless of whether you find malicious files. Revoke GitHub personal access tokens for any account that recently had an unexplained login. Do not wait for GitHub's notification workflow -- 378 repositories are still exposed today.
How GhostAction Steals GitHub Actions Secrets
GitHub Actions is a CI/CD automation platform that executes workflow YAML files stored in a repository's .github/workflows/ directory. Workflows run on GitHub-hosted or self-hosted compute (runners) and have access to secrets that repository administrators configure through the GitHub UI. These secrets are injected into the runner environment as encrypted environment variables at execution time and are accessible via the standard ${{ secrets.SECRET_NAME }} syntax.
GhostAction's exploitation chain begins with maintainer account compromise through credential theft or phishing. Once an attacker controls a maintainer account, they have write access to the repository's default branch without requiring a pull request review -- a common configuration in smaller open source projects and many enterprise repositories with relaxed branch protection rules. The attacker adds a malicious workflow YAML file in a single commit and pushes directly to the default branch. The commit message is designed to appear routine: "Add Github Actions Security workflow" or "Add security check workflow."
On the next legitimate developer push, GitHub's scheduler runs all workflows in .github/workflows/ including the new malicious file. The malicious workflow's steps execute in sequence: the runner environment reads secrets from the execution context, the curl command sends the collected credentials via HTTP POST to 193.32.204.199/?c=monami, and the workflow exits normally. Nothing in the standard GitHub Actions output logs exposes this exfiltration unless the administrator has enabled enhanced logging or deployed outbound traffic monitoring on self-hosted runners.
The 2026 security-audit.yml variant adds a second exfiltration stage. After collecting current environment secrets, it runs a full git checkout of the repository history and scans commit diffs for credential-shaped strings using regex patterns tuned to AWS key formats, GitHub token prefixes, and common API key structures. This second stage recovers credentials that developers rotated but forgot to scrub from git history -- a class of secret that remains valid if the rotation was incomplete.
Subscribe to unlock Indicators of Compromise
Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.
Scale, Impact, and Targeted Secrets
GhostAction has run in two documented waves with distinct targeting profiles. The September 2025 campaign compromised 327 GitHub accounts across 817 repositories, exfiltrating 3,325 secrets before GitGuardian detected the activity. The 2026 resurgence, active from August 31 through September 30, expanded to 373 compromised users and organizations across 772 repositories, targeting 2,577 secrets.
Confirmed successful exfiltration in the 2026 wave reached 26 secrets from 13 repositories based on observed C2 traffic. The lower confirmed number relative to targeted repositories reflects GitHub's workflow approval gate, which holds runs from first-time external contributors for manual review. However, organizations with more permissive workflow settings -- including many enterprise repositories where maintainer pushes bypass approval -- experienced immediate exfiltration on the first workflow trigger.
The most significant targeting shift in 2026 is the inclusion of AI provider API keys. GhostAction's malicious workflow variants now explicitly scan for credentials matching Anthropic API key prefixes (sk-ant-), OpenAI API key formats (sk-proj- and sk-), and OpenRouter authentication tokens. These credentials carry direct financial exposure: a stolen Anthropic or OpenAI key enables inference abuse at scale, with costs billed to the compromised organization's account before any rate limiting or fraud detection triggers.
AWS access keys remain the highest-volume credential class in the exfiltrated data, consistent with prior supply chain campaigns. The LiteLLM supply chain attack exposed 434,000 CI/CD pipeline credentials using a similar pipeline access pattern, demonstrating how developer tooling occupies a structural weak point where cloud credentials converge. GhostAction's git history mining variant compounds the risk: many organizations rotate active secrets but do not perform git history scrubbing, leaving historical AWS keys and GitHub tokens recoverable from commits made months or years before the compromise.
Briefings like this, every morning before 9am.
Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.
Sigma Detection Rules for GhostAction
These rules detect malicious workflow file creation in GitHub repositories and suspicious HTTP POST exfiltration matching the GhostAction C2 pattern. Both carry experimental status; validate against your environment's log format before enabling automatic blocking.
Subscribe to unlock Sigma Detection Rules
Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.
Subscribe to unlock Sigma Hunt Queries
Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.
Subscribe to unlock WAF Detection Rules
Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.
How to Audit and Remediate a Compromised Repository
Every organization that uses GitHub Actions should complete this audit today regardless of whether they have confirmed GhostAction activity. The malicious workflow is self-contained and silent: it leaves no trace in your application code, only in the workflow directory and git history.
Subscribe to unlock Remediation & Mitigation steps
Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.
Why Developer Pipelines Are the New Perimeter
GhostAction represents a structural shift in how threat actors approach enterprise compromise. Five years ago, the standard initial access path was direct exploitation of perimeter devices: VPNs, firewalls, mail gateways. Today, the same organizations that patched those devices rapidly still expose high-privilege credential stores through CI/CD pipelines that security teams classify as development infrastructure rather than production.
The practical consequence is a security gap with significant blast radius. A GitHub Actions secret grants the same AWS or Azure access as a production IAM credential, without the geographic access restrictions, device trust checks, or conditional access policies that govern interactive logins. An attacker who steals a pipeline AWS access key during a GitHub Actions workflow run can invoke AWS APIs from any IP address without MFA challenge.
The addition of AI provider API keys to GhostAction's targeting profile reflects a financial reality: Anthropic and OpenAI API access is priced per token, and a stolen key enables inference abuse at costs that can reach hundreds of thousands of dollars in a single week before rate limits or anomaly detection triggers. The Chrome extension supply chain attack targeting crypto theft used a similar logic -- high-value credentials held in developer tooling are worth more than the same credentials behind interactive MFA because they are designed to be used programmatically without human authentication friction.
The organizations most exposed to GhostAction are those with open source repositories where external contributors can trigger workflow runs, enterprises with large numbers of GitHub maintainer accounts that lack phishing-resistant MFA, and teams that granted pipelines broad cloud permissions to simplify deployment without applying the principle of least privilege to IAM roles used by CI runners.
“GhostAction is not a novel attack -- it is a supply chain technique refined over 13 months of continuous operation. The 378 repositories still carrying the live malicious workflow today are not a tail-risk scenario. They are active exfiltration opportunities waiting for the next developer push.”
GitGuardian, GhostAction 2026 Resurgence Analysis, October 2026
Protecting Your GitHub Actions Pipeline Long-Term
Blocking GhostAction requires more than removing the malicious workflow file. Organizations that remove the workflow but do not revoke compromised account access will see the same workflow re-injected on the next opportunity. The remediation sequence must address both the workflow artifact and the access vector.
At the organizational level, require phishing-resistant MFA for all members. Audit GitHub personal access tokens organization-wide and enforce maximum expiration policies (90 days for service accounts, 30 days for interactive PATs). Deploy repository rulesets that prevent direct pushes to default branches and require pull request approvals for any changes to .github/workflows/. Enable GitHub Advanced Security's secret scanning with push protection to catch credentials in workflow files before they land in the repository.
At the pipeline level, adopt OpenID Connect (OIDC) for cloud provider authentication instead of long-lived secrets. OIDC tokens are issued per-workflow-run and expire automatically, eliminating the persistent credential that GhostAction targets. AWS, Azure, and GCP all support OIDC federation with GitHub Actions. Migrating from IAM access keys to OIDC removes the entire credential class GhostAction's exfiltration step targets.
Monitor GitHub Actions network egress. Self-hosted runners can have outbound traffic filtered through an egress proxy; GitHub-hosted runners support IP allow-lists that restrict which external endpoints a workflow can reach. Block the GhostAction C2 IP (193.32.204.199) at your egress proxy or network firewall for any CIDR range used by GitHub-hosted runners.
For organizations that cannot immediately enforce OIDC, use GitHub's encrypted secret environment scoping to restrict which workflows can read which secrets. Apply the principle of least privilege: a workflow that deploys to a staging environment should not have access to production credentials. Segment your secret stores so a compromised workflow can only access secrets relevant to its specific deployment context.
The bottom line
GhostAction has operated without interruption since September 2025, adapting its techniques to mine git history and target AI provider API keys in its 2026 resurgence. The campaign's persistence -- 378 repositories still carry the live malicious workflow today -- reflects how developer infrastructure escapes the security scrutiny applied to production systems. Three actions matter most: audit your .github/workflows/ directories for the three known malicious file names, rotate every GitHub Actions secret in any affected repository, and enforce phishing-resistant MFA to eliminate the credential theft vector that gives the threat actor initial access. Organizations on GitHub-hosted runners should add 193.32.204.199 to their network block lists today. The threat actor's investment in this campaign over 13 months signals that it will continue -- the only question is whether your pipeline secrets are in the next exfiltration batch.
This analysis is generic. create a free account to score threats like this against your own stack.
Frequently asked questions
What is GhostAction?
GhostAction is a persistent supply chain campaign first detected in September 2025 that compromises GitHub maintainer accounts and injects malicious YAML workflow files into GitHub Actions CI/CD pipelines. The malicious workflows masquerade as security checks, execute on legitimate developer pushes, read GitHub Actions secrets from the runner environment, and send them to attacker infrastructure via HTTP POST. The campaign has run in two documented waves: September 2025 (3,325 secrets from 817 repos) and August-September 2026 (2,577 secrets targeted across 772 repos).
How does GhostAction inject malicious workflows?
Attackers first compromise a GitHub maintainer account through credential theft or phishing. Once they have write access, they add a malicious workflow YAML file to the .github/workflows/ directory of every repository that account can modify. The workflow is committed with an innocuous message such as 'Add Github Actions Security workflow' or 'Add security check workflow.' Because the file is in the standard workflow directory, GitHub treats it as legitimate and runs it automatically on the next push event triggered by any developer.
Which secrets does GhostAction target?
GhostAction targets any secret stored in GitHub Actions environments, including AWS access keys and secret access keys, GitHub personal access tokens, cloud provider credentials (Azure, GCP), and, in the 2026 resurgence, API keys for AI providers including Anthropic, OpenAI, and OpenRouter. The 2026 security-audit.yml variant also searches the full git commit history using contextual string matching, capturing credential-shaped values from older commits that may have been previously removed from the codebase but remain in git history.
How do I know if my GitHub repository is compromised?
Check your repository's .github/workflows/ directory for any of these files: github_actions_security.yml, security-check.yml, or security-audit.yml. Also search your git log for commits with messages containing 'Add Github Actions Security workflow', 'Update Github Actions Security workflow', or 'Add security check workflow'. Review GitHub Actions run logs for any workflow run that makes unexpected outbound HTTP requests. Check whether any maintainer account in your organization shows logins from unfamiliar locations or IP addresses around the time suspicious commits appeared.
What are the GhostAction malicious workflow file names?
Three distinct workflow file names have been confirmed across both GhostAction waves. The primary variant is github_actions_security.yml with the display name 'Github Actions Security.' The secondary variant is security-check.yml with the display name 'Security Check,' observed in seven repositories. The 2026 variant is security-audit.yml, which adds full git history mining. All three trigger on push events and use curl to send collected secrets to the same C2 infrastructure. Audit all three names and also inspect any recently added workflow files not authored by known team members.
How do I detect GhostAction activity in GitHub Actions logs?
In GitHub Actions run logs, look for curl or wget commands in workflow steps that were not part of your original workflow definition. Specifically, search for outbound HTTP POST requests to 193.32.204.199 or connections using the URI path /?c=monami. At the repository level, use the GitHub Audit Log to find workflow file creation events (git.push events) where the actor is not a recognized team member. Monitor for new .github/workflows/ files committed without a corresponding pull request review. GitHub's organization audit log exports can be parsed with standard SIEM tools to build automated alerts on these patterns.
Why are CI/CD pipelines high-value targets?
CI/CD pipelines hold the highest-privilege credentials in most organizations: production deployment keys, cloud provider root credentials, package signing certificates, and database passwords. These secrets are granted to pipelines precisely because pipelines need to deploy to production, publish packages, and access infrastructure. A single compromised pipeline secret gives attackers the same access as a senior engineer performing a production deployment, often without triggering MFA or conditional access policies that would flag an interactive login. The 2026 GhostAction wave's focus on Anthropic and OpenAI API keys reflects how AI infrastructure costs now make those credentials financially valuable for cryptomining and API abuse at scale.
What is new about the 2026 GhostAction resurgence?
Three significant changes distinguish the 2026 wave from the 2025 campaign. First, the new security-audit.yml variant mines the entire git commit history, not just current environment variables, recovering credentials removed in previous rotations. Second, the 2026 wave specifically targets AI provider API keys from Anthropic, OpenAI, and OpenRouter, reflecting the financial value of these credentials for AI inference abuse and cryptomining. Third, the campaign's infrastructure and delivery mechanism improved: the 2026 malicious workflows send contextual lines surrounding credential-shaped strings rather than raw environment dumps, making the exfiltrated data more immediately actionable for the threat actor.
Sources & references
- GitGuardian: GhostAction Returns: 772 Repos Hit in New GitHub Actions Wave
- Security Boulevard: The Campaign That Never Stopped: Tracking GhostAction from 2025 to 2026
- GitGuardian: GhostAction Campaign: 3,325 Secrets Stolen Through Compromised GitHub Workflows
- SecurityWeek: GitHub Workflows Attack Affects Hundreds of Repos, Thousands of Secrets
- MITRE ATT&CK: T1195.001 Supply Chain Compromise
- GitHub Docs: Security hardening for GitHub Actions
Free resources
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
Daily briefings + Google Top Stories in one step.
Enter your email and we'll subscribe you to the daily briefing and add Decryption Digest to your Google Search feed at the same time.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals every morning.