GhostAction Campaign Targets Cloud and AI Credentials in Tens of Thousands of GitHub Repositories
Attackers injected malicious workflows into tens of thousands of repositories to harvest cloud and AI keys since October 2026.
Key points
- Over 500 GitHub accounts were compromised in the GhostAction campaign.
- Malicious workflows were injected into tens of thousands of repositories.
- The operation targeted cloud credentials and AI service API keys.
Organisations using GitHub for software development face significant credential theft risks after the GhostAction threat campaign expanded its reach. According to GBHackers, attackers compromised more than 500 GitHub accounts and injected malicious workflows into tens of thousands of repositories. The campaign, which began in October 2026, specifically targets sensitive data stored within GitHub Actions secrets, cloud service credentials, and artificial intelligence service API keys embedded in source code and repository history.
How it unfolded
- On 7 October 2026, the GhostAction campaign began injecting malicious workflows into compromised GitHub repositories.
- By 9 October 2026, Socket reported the operation had expanded to over 500 compromised accounts.
- Attackers focused on harvesting secrets from GitHub Actions, cloud credentials, and AI keys within repository histories.
Who is affected
The scope of the breach extends beyond the initial compromised accounts. According to Socket’s update on 9 October, the attackers successfully injected malicious workflows into tens of thousands of repositories. This widespread injection allows the threat actors to access sensitive configuration data that developers often store for automation purposes. The primary targets are GitHub Actions secrets, which are used to authenticate and authorise actions within the platform.
Additionally, attackers are harvesting cloud credentials that provide access to external infrastructure, as well as API keys for various artificial intelligence services. These keys are often embedded directly in source code or left exposed in the public history of repositories, making them vulnerable to automated scraping tools employed by the attackers.
The fix
No official patch or remediation guide has been confirmed by GitHub or the vendor for this specific campaign. Organisations should assume that any repository with unknown workflow files may be compromised. Developers must audit their GitHub Actions secrets and rotate any cloud credentials or AI API keys that may have been exposed. Since the attack leverages existing repository history, simply deleting current malicious files may not be sufficient if the secrets were previously committed and remain in the git log. Security teams should monitor for unusual workflow executions and unexpected outbound connections from their CI/CD pipelines.
Background: Threat actors
A threat actor is any entity that initiates a cyber attack. They range from automated software to organised criminal groups. Understanding their motive helps you predict their behaviour. Most are not after you specifically but exploit common weaknesses for quick financial gain.
Read the full guide: Threat Actors Explained: Motives, Methods and Misconceptions
What to do and how to stay safe: GitHub
- Audit all GitHub Actions workflows in your repositories for unauthorised or unfamiliar files that were added recently.
- Rotate any cloud service credentials or AI API keys that have been stored in GitHub secrets or repository history.
- Review repository commit histories to identify if sensitive keys were ever committed and remain accessible in older versions.
- Monitor CI/CD pipeline logs for unexpected executions or outbound network traffic to unknown destinations.
Step-by-step guide: Incident Response Plans: Real Benefits and Hidden Costs
General security guidance from the Malware Brief newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many GitHub accounts were compromised in the GhostAction campaign?
More than 500 GitHub accounts were compromised, with malicious workflows injected into tens of thousands of repositories.
What specific data are the attackers stealing?
The attackers are targeting GitHub Actions secrets, cloud service credentials, and AI service API keys found in source code and history.
When did this campaign start?
The GhostAction campaign began injecting malicious workflows on 7 October 2026, according to reports by GBHackers.
