--- title: GhostAction Returns: Malicious “Security Audit”... description: A follow-up investigation into the GhostAction supply-chain campaign reveals that attackers compromised two high-profile maintainer accounts—pyxel's Takashi... canonical: https://daily.dev/posts/ghostaction-returns-malicious-security-audit-workflows-now-mine-credentials-from-entire-git-histo-9iwzmwu4v twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: GhostAction Returns: Malicious “Security Audit” Workflows Now Mine Credentials from Entire Git Histories | daily.dev og:description: A follow-up investigation into the GhostAction supply-chain campaign reveals that attackers compromised two high-profile maintainer accounts—pyxel's Takashi... og:url: https://daily.dev/posts/ghostaction-returns-malicious-security-audit-workflows-now-mine-credentials-from-entire-git-histo-9iwzmwu4v og:image: https://api.daily.dev/og/posts/9IWzmwu4v.png og:image:alt: GhostAction Returns: Malicious “Security Audit” Workflows Now Mine Credentials from Entire Git Histories og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # GhostAction Returns: Malicious “Security Audit” Workflows Now Mine Credentials from Entire Git Histories **[StepSecurity](https://daily.dev/sources/stepsecurity)** · 12 min read · 0 upvotes · 0 comments ## Summary A follow-up investigation into the GhostAction supply-chain campaign reveals that attackers compromised two high-profile maintainer accounts—pyxel's Takashi Kitao and athenadriver's Henry Wu—on October 8, 2026, pushing a malicious 'Security Audit' workflow to 345 repositories, including Uber's codebase. Unlike the original 2025 campaign that only exfiltrated named GitHub Actions secrets, the new variant uses fetch-depth:0 checkouts and git log -p --all to mine credentials from the entire git history, including secrets deleted years ago. It also targets AI-provider API keys (Anthropic, OpenAI, OpenRouter), pairs AWS access key IDs with their secret keys via context capture, and exfiltrates everything over plain HTTP to a raw IP, bypassing DNS-based defenses. 378 repositories still carry the live malicious workflow as of publication; no malicious package releases have been confirmed yet, but exposure remains until tokens are rotated. Rotating current secrets no longer suffices since historical secrets are also compromised; workflow approval gates were the only observed control that stopped exfiltration. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the GhostAction GitHub Actions attack and how does the October 2026 version differ from the 2025 campaign? GhostAction is a supply-chain campaign that compromises maintainer GitHub accounts and pushes a malicious workflow disguised as a 'Security Audit' that exfiltrates secrets to an attacker server. The October 2026 wave adds full git-history mining via git log -p --all and fetch-depth:0 checkout, so secrets deleted years ago are still harvested, plus AI-provider API keys (Anthropic, OpenAI, OpenRouter) and AWS key-ID-to-secret-key pairing via context capture, all sent over plain HTTP to a raw IP (193.32.204.199), bypassing DNS-based defenses. _Teams running CI/CD pipelines follow daily.dev to catch supply-chain attacks like this before secrets are exfiltrated._ ### Why isn't rotating GitHub Actions secrets enough to remediate a GhostAction-style compromise? Rotating currently configured secrets no longer covers the exposure because the malicious workflow runs git log -p --all against a full-history checkout (fetch-depth: 0), harvesting any credential pattern ever committed to the repository, even one added and deleted years earlier such as 2019. Any secret value that ever appeared in the repository's history must be treated as compromised and rotated, not just the secrets currently defined in the repo settings. _Developers hardening CI/CD pipelines track remediation guidance like this on daily.dev before the next git-history credential sweep hits._ ### What GitHub Actions configuration stopped the GhostAction exfiltration workflow from running? Requiring approval for workflow runs stopped the exfiltration chain in at least one observed case: a repository with that setting had two re-triggered runs stall in the action_required state instead of executing, because the account that pushed the malicious commits lacked permission to auto-approve its own workflow runs. Combined with an allowed-endpoints egress allowlist and branch protection on .github/workflows/*, this was the single control shown to break the attack. _Platform engineers locking down CI/CD workflows compare mitigation controls like this on daily.dev._ ## Similar posts on daily.dev - [Introducing Secret Exfiltration Protection for GitHub Actions](https://daily.dev/posts/introducing-secret-exfiltration-protection-for-github-actions-f3llaeq8h) · StepSecurity · 0 upvotes · 0 comments - [Securing the open source supply chain across GitHub](https://daily.dev/posts/securing-the-open-source-supply-chain-across-github-k6lf4rzyu) · GitHub Blog · 0 upvotes · 0 comments - [‘GitLost’ Flaw Lets Attackers Trick GitHub AI Agent Into Leaking Private Repos](https://daily.dev/posts/gitlost-flaw-lets-attackers-trick-github-ai-agent-into-leaking-private-repos-h2sgta49s) · DevOps.com · 0 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#devsecops](https://daily.dev/tags/devsecops), [#github](https://daily.dev/tags/github), [#github-actions](https://daily.dev/tags/github-actions), [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/ghostaction-returns-malicious-security-audit-workflows-now-mine-credentials-from-entire-git-histo-9iwzmwu4v) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"GhostAction Returns: Malicious “Security Audit” Workflows Now Mine Credentials from Entire Git Histories","url":"https://daily.dev/posts/ghostaction-returns-malicious-security-audit-workflows-now-mine-credentials-from-entire-git-histo-9iwzmwu4v","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ghostaction-returns-malicious-security-audit-workflows-now-mine-credentials-from-entire-git-histo-9iwzmwu4v"},"datePublished":"2026-10-09T14:45:46.644Z","dateModified":"2026-10-29T02:14:08.861Z","description":"A follow-up investigation into the GhostAction supply-chain campaign reveals that attackers compromised two high-profile maintainer accounts—pyxel's Takashi...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5dd4fef47ea94e2e6deff20a7eda5f64?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5dd4fef47ea94e2e6deff20a7eda5f64?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"StepSecurity","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"StepSecurity","logo":"https://media.daily.dev/image/upload/s--vegWii-S--/f_auto,q_auto/v1774959924/logos/stepsecurity?_a=BAMAMiWQ0","url":"https://daily.dev/sources/stepsecurity"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ghostaction-returns-malicious-security-audit-workflows-now-mine-credentials-from-entire-git-histo-9iwzmwu4v","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,devsecops,github,github-actions,security","timeRequired":"PT12M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"StepSecurity","item":"https://daily.dev/sources/stepsecurity"},{"@type":"ListItem","position":3,"name":"GhostAction Returns: Malicious “Security Audit” Workflows Now Mine Credentials from Entire Git Histories"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/ghostaction-returns-malicious-security-audit-workflows-now-mine-credentials-from-entire-git-histo-9iwzmwu4v#faq","mainEntity":[{"@type":"Question","name":"What is the GhostAction GitHub Actions attack and how does the October 2026 version differ from the 2025 campaign?","acceptedAnswer":{"@type":"Answer","text":"GhostAction is a supply-chain campaign that compromises maintainer GitHub accounts and pushes a malicious workflow disguised as a 'Security Audit' that exfiltrates secrets to an attacker server. The October 2026 wave adds full git-history mining via git log -p --all and fetch-depth:0 checkout, so secrets deleted years ago are still harvested, plus AI-provider API keys (Anthropic, OpenAI, OpenRouter) and AWS key-ID-to-secret-key pairing via context capture, all sent over plain HTTP to a raw IP (193.32.204.199), bypassing DNS-based defenses. Teams running CI/CD pipelines follow daily.dev to catch supply-chain attacks like this before secrets are exfiltrated."}},{"@type":"Question","name":"Why isn't rotating GitHub Actions secrets enough to remediate a GhostAction-style compromise?","acceptedAnswer":{"@type":"Answer","text":"Rotating currently configured secrets no longer covers the exposure because the malicious workflow runs git log -p --all against a full-history checkout (fetch-depth: 0), harvesting any credential pattern ever committed to the repository, even one added and deleted years earlier such as 2019. Any secret value that ever appeared in the repository's history must be treated as compromised and rotated, not just the secrets currently defined in the repo settings. Developers hardening CI/CD pipelines track remediation guidance like this on daily.dev before the next git-history credential sweep hits."}},{"@type":"Question","name":"What GitHub Actions configuration stopped the GhostAction exfiltration workflow from running?","acceptedAnswer":{"@type":"Answer","text":"Requiring approval for workflow runs stopped the exfiltration chain in at least one observed case: a repository with that setting had two re-triggered runs stall in the action_required state instead of executing, because the account that pushed the malicious commits lacked permission to auto-approve its own workflow runs. Combined with an allowed-endpoints egress allowlist and branch protection on .github/workflows/*, this was the single control shown to break the attack. Platform engineers locking down CI/CD workflows compare mitigation controls like this on daily.dev."}}]} ```