Identity · Application Security
Malicious GitHub Actions Workflows Stole Credentials from Thousands of Repositories
Attackers used compromised maintainer accounts to plant credential-stealing workflows in tens of thousands of GitHub repositories, targeting developer secrets and cloud credentials.
Ross GrantUpdated 3 min read
The short version
Attackers broke into the accounts of popular open-source developers on GitHub and used their access to add a harmful workflow to many code repositories. This workflow searched for sensitive information like passwords and cloud keys, then sent them to the attackers. If you use GitHub, check your repositories for suspicious workflow files and change any secrets that might have been exposed.
By the numbers
- tens of thousandsrepositories affected by malicious workflowsThe Hacker News
- 500+GitHub accounts used to spread the attackThe Hacker News
- 3,325secrets exfiltrated in earlier GhostAction incidentsThe Hacker News
- 817repositories compromised in previous GhostAction attacksThe Hacker News
What happened?
Attackers compromised two high-profile GitHub maintainer accounts and used them to push a credential-stealing workflow to hundreds of repositories in October 2026. Security researchers say the campaign, called GhostAction, has since spread to tens of thousands of repositories, targeting developer secrets and cloud credentials. Only one outlet has reported this so far, and the full impact is still unclear.
Attackers Target Open-Source Maintainers to Spread Malicious Workflows
According to The Hacker News (opens in a new tab), attackers compromised two well-known open-source maintainer accounts on GitHub in early October 2026. Using these accounts, they pushed a malicious workflow to hundreds of repositories. The first account, belonging to Takashi Kitao (author of the popular Pyxel game engine), was used to add the workflow to 27 repositories. Hours later, the account of Henry Wu (creator of Uber's athenadriver) was used to push the same workflow to 318 repositories in just 16 minutes.
Scale of the Attack and Ongoing Campaign
Security firms StepSecurity and Socket reported that, as of 9 October 2026, more than 500 GitHub accounts had committed the malicious workflow to tens of thousands of repositories since 7 October. This activity is linked to a broader supply chain attack campaign named "GhostAction", which has been active since at least September 2025. Previous incidents tied to GhostAction led to the compromise of 817 repositories and the theft of over 3,000 secrets, including tokens for popular package registries and cloud services.
How the Malicious Workflow Operates
The attackers injected a workflow file named either security-audit.yml or github_actions_security.yml into the default branch of affected repositories. The workflow was designed to look like a legitimate security audit but actually scanned for sensitive information and sent it to an attacker-controlled server. Specifically, it searched for secrets in the repository, the working directory, and the entire git history, targeting credentials for AWS, Google Cloud, AI services, SaaS platforms, and more. The workflow sent any found secrets over plain HTTP to a hard-coded IP address.
What Was Stolen and Who Is at Risk
The stolen data included a wide range of credentials: AWS keys, API tokens for AI providers like OpenAI and Anthropic, DockerHub credentials, SSH private keys, database credentials, and messaging bot tokens for services like Slack and Discord. Both public and private repositories were affected, but private forks and mirrors are especially at risk because they often contain sensitive, committed credentials. The attack also mapped out which repositories could be accessed, even if no secrets were found.
What Developers Should Do Now
Security researchers recommend that developers check their repositories for the presence of these suspicious workflow files, especially if they were added since 31 August 2026. If found, the advice is to revoke any potentially compromised credentials, rotate all secrets, remove the malicious workflow from every branch, and check all forks of the affected repositories. Downstream forks and private mirrors may also be at risk, especially if they inherit the malicious workflow.
Uncertainties and Ongoing Investigation
So far, only The Hacker News (opens in a new tab) has reported on this campaign, and there is no confirmation from GitHub or other primary sources. It is not yet clear how many secrets have been abused or if any major software supply chains have been compromised as a result. The full impact is still being investigated, and more information may emerge as vendors and affected users respond.
Claimed vs confirmed
- Confirmed
Attackers compromised two high-profile maintainer accounts and used them to spread malicious workflows.
Reported by The Hacker News, citing StepSecurity and Socket.
- Confirmed
More than 500 accounts have committed the malicious workflow to tens of thousands of repositories.
Reported by The Hacker News, citing Socket.
- Confirmed
No malicious package releases have been published using compromised credentials.
Reported by The Hacker News.
The impact
- Money
- If stolen credentials are used to access cloud services or publish malicious packages, affected organisations could face significant costs. Under UK GDPR, fines can reach up to £17.5 million or 4% of global turnover if personal data is involved.
- Reputation
- Trust in open-source projects and GitHub as a platform may be damaged, especially if popular projects are compromised. Developers may be more cautious about using third-party code.
- Customers
- Anyone using affected repositories could be at risk if secrets are abused. Developers should check for malicious workflows and rotate any credentials that may have been exposed.
Why it matters
This attack puts thousands of open-source projects and their users at risk. Stolen credentials could let attackers access cloud services, publish malicious software, or steal data. Developers and organisations using GitHub should check their repositories and rotate any exposed secrets.
How does it work?
Attackers gained access to maintainer accounts, likely using leaked personal access tokens. They injected a malicious GitHub Actions workflow into repositories, which scanned for secrets in the codebase and git history, then sent any found credentials to an attacker-controlled server over plain HTTP.
Key points
- Attackers used compromised maintainer accounts to spread malicious GitHub Actions workflows.
- The workflows stole secrets and credentials from thousands of repositories.
- Private forks and mirrors are especially at risk due to stored credentials.
- Developers should check for suspicious workflow files and rotate any exposed secrets.
- The full scale and impact of the attack are still being investigated.
Sources
The Hacker News
Reference
