--- title: GhostAction supply chain campaign returns, hitting... description: GhostAction, a GitHub Actions supply chain attack first identified in September 2025, has resurfaced with a wave starting August 31, 2026 that hit 772... canonical: https://daily.dev/posts/ghostaction-supply-chain-campaign-returns-hitting-hundreds-of-github-repositories-ewps6jegr twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: GhostAction supply chain campaign returns, hitting hundreds of GitHub repositories | daily.dev og:description: GhostAction, a GitHub Actions supply chain attack first identified in September 2025, has resurfaced with a wave starting August 31, 2026 that hit 772... og:url: https://daily.dev/posts/ghostaction-supply-chain-campaign-returns-hitting-hundreds-of-github-repositories-ewps6jegr og:image: https://api.daily.dev/og/posts/eWpS6JEGr.png og:image:alt: GhostAction supply chain campaign returns, hitting hundreds of GitHub repositories og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # GhostAction supply chain campaign returns, hitting hundreds of GitHub repositories **[Collections](https://daily.dev/sources/collections)** · 3 min read · 1 upvotes · 1 comments ## Summary GhostAction, a GitHub Actions supply chain attack first identified in September 2025, has resurfaced with a wave starting August 31, 2026 that hit 772 repositories across 373 users, targeting 2,577 secrets including SSH keys, Azure credentials, container registry tokens, database credentials and AWS keys. A separate count found 346 repos with a malicious security-audit.yml workflow, including uber/athenadriver and kitao/pyxel. The updated workflow now scans the full git history and working tree for cloud and AI credentials and exfiltrates them in cleartext to a hardcoded IP. GitGuardian's analysis suggests the campaign never actually paused between waves, just kept reusing and updating injected workflows. A separate, likely unrelated cryptominer was also found hidden in DevOpsGPT. Maintainers are urged to revoke compromised GitHub credentials (not just rotate secrets) and audit git history for old committed credentials. ## Content GhostAction is a supply chain campaign that plants credential-stealing GitHub Actions workflows in repositories. It was first exposed in September 2025. GitGuardian, which tracks it, says it never really stopped. ## How the attack works The attackers don't exploit a flaw in a third-party action, as happened with the earlier tj-actions/changed-files compromise. They use stolen developer credentials, likely leaked personal access tokens, to commit workflow changes directly. The workflows get innocuous names such as security-audit.yml. Once running, a malicious job collects secrets and sends them by curl POST to an attacker-controlled server. In the first wave, the jobs used actions/checkout with fetch-depth:0 to pull the full Git history. The targets included AWS keys, GitHub and GitLab tokens, Google and Firebase keys, and AI provider keys from Anthropic, OpenAI and OpenRouter. ## The first wave GitGuardian counted about 1,900 compromised GitHub accounts and more than 30,000 repositories. The biggest push came on October 8-9, hitting about 3,000 users and organizations and targeting 3,174 secrets. GitHub's approval controls blocked many new workflows, but the attackers reused 92 older malicious ones. By October 5, only 16% of affected repositories from the earlier August-September wave had been cleaned up. Socket later identified more than 500 GitHub accounts that committed the malicious workflow to tens of thousands of repositories. ## The new wave GitGuardian reports a fresh wave that began August 31, 2026. Through September 30 it hit 772 public repositories across 373 users and targeted 2,577 secrets: SSH keys, Azure and AWS credentials, container registry tokens and database credentials. Everything was sent to a bare IP address, 193.32.204.199. The tracking data shows the campaign never paused between waves. Since 2025 the same injected workflows have been repointed at several different endpoints, and in some cases the attacker simply edited old workflows that nobody had removed. An October 9 update describes another burst hitting 346 repositories, including uber/athenadriver and kitao/pyxel (18,420 stars). This time exfiltration succeeded, and the scope is wider. The workflow scans the working tree and full Git history for cloud and AI credentials, not just GitHub Actions secrets, and sends them in cleartext to a single hardcoded IP. ## An unrelated cryptominer GitGuardian also found an XMRig cryptominer hidden in kuafuai/DevOpsGPT through a disguised commit. It was pushed from the same compromised account that later received a GhostAction injection. The evidence points to a different, unrelated actor reusing leaked credentials. ## What to do Rotating exposed secrets isn't enough. GitGuardian stresses that the compromised GitHub credential behind the injection has to be found and revoked, because several unrelated attackers appear to be reusing the same leaked tokens, and they may be shared or resold. - Audit recent workflow changes, especially unfamiliar files like security-audit.yml. - Revoke access for compromised accounts and tokens. - Rotate every credential that may have been exposed, including ones deleted from current code but still in Git history. ## Questions this post answers ### What is the GhostAction GitHub Actions supply chain attack and how does it work? GhostAction is a campaign where attackers use stolen GitHub credentials to push a malicious workflow, often named security-audit.yml, into repositories. The workflow reads secrets referenced in other workflows and exfiltrates them via HTTP requests to attacker-controlled servers. First exposed in September 2025, a new wave starting August 31, 2026 hit 772 repositories, 373 users, and 2,577 secrets. _Teams hardening CI/CD pipelines against credential theft can follow supply chain security coverage on daily.dev._ ### Is rotating secrets enough after a GhostAction GitHub Actions compromise? No, rotating stolen secrets alone is insufficient because the GitHub credentials that let attackers inject the malicious workflow in the first place must also be revoked. These credentials may be shared or resold among multiple threat actors, so a rotated secret can be stolen again if the original access point remains open. Maintainers should also check git history, since the attack now reads committed history, not just the current tree. _Maintainers responding to credential leaks can track incident response guidance like this on daily.dev._ ### What data does the updated GhostAction malicious workflow steal from GitHub repositories? The updated workflow scans both the working tree and the full git history for cloud and AI credentials, including SSH keys, Azure credentials, container registry tokens, database credentials, and AWS keys, then sends them in cleartext to a single hardcoded IP address. This goes beyond the original version, which only targeted CI/CD secrets already referenced in a repository's workflows. _Developers auditing repositories for injected workflows can follow supply chain security news on daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@etal** · 0 upvotes > A credentials infrastructure like AgentSecrets could be useful in cases like this ## Similar posts on daily.dev - [GhostAction Returns: Malicious “Security Audit” Workflows Now Mine Credentials from Entire Git Histories](https://daily.dev/posts/ghostaction-returns-malicious-security-audit-workflows-now-mine-credentials-from-entire-git-histo-9iwzmwu4v) · StepSecurity · 0 upvotes · 0 comments - [Is GitHub Actions Putting Your Software at Risk?](https://daily.dev/posts/is-github-actions-putting-your-software-at-risk--a2b2a1jji) · Atomic Spin · 0 upvotes · 0 comments - [The vulnerabilities nobody sees in your repository, and how to catch them before they merge](https://daily.dev/posts/the-vulnerabilities-nobody-sees-in-your-repository-and-how-to-catch-them-before-they-merge-qmufkovsn) · Medium · 1 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#open-source](https://daily.dev/tags/open-source), [#cicd](https://daily.dev/tags/cicd), [#github-actions](https://daily.dev/tags/github-actions), [#secrets-management](https://daily.dev/tags/secrets-management) [View this post on daily.dev](https://daily.dev/posts/ghostaction-supply-chain-campaign-returns-hitting-hundreds-of-github-repositories-ewps6jegr) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"GhostAction supply chain campaign returns, hitting hundreds of GitHub repositories","url":"https://daily.dev/posts/ghostaction-supply-chain-campaign-returns-hitting-hundreds-of-github-repositories-ewps6jegr","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ghostaction-supply-chain-campaign-returns-hitting-hundreds-of-github-repositories-ewps6jegr"},"datePublished":"2026-10-09T13:53:02.195Z","dateModified":"2026-10-15T21:50:29.044Z","description":"GhostAction, a GitHub Actions supply chain attack first identified in September 2025, has resurfaced with a wave starting August 31, 2026 that hit 772...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9f9629490d6dfd57db0743952e33dfe2?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9f9629490d6dfd57db0743952e33dfe2?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/ghostaction-supply-chain-campaign-returns-hitting-hundreds-of-github-repositories-ewps6jegr","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"cyber,open-source,cicd,github-actions,secrets-management","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"GhostAction supply chain campaign returns, hitting hundreds of GitHub repositories"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/ghostaction-supply-chain-campaign-returns-hitting-hundreds-of-github-repositories-ewps6jegr","comment":[{"@type":"Comment","text":"A credentials infrastructure like AgentSecrets could be useful in cases like this","datePublished":"2026-10-09T20:43:40.568Z","url":"https://daily.dev/posts/eWpS6JEGr#c-58DMobZX9","author":{"@type":"Person","name":"Wisdom Ademiju","url":"https://daily.dev/etal","image":"https://media.daily.dev/image/upload/s--iSWfWEVP--/f_auto/v1791476397/avatars/avatar_8CWhNDmJaO7smzKuYZEre?_a=BAMAMicg0"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/ghostaction-supply-chain-campaign-returns-hitting-hundreds-of-github-repositories-ewps6jegr#faq","mainEntity":[{"@type":"Question","name":"What is the GhostAction GitHub Actions supply chain attack and how does it work?","acceptedAnswer":{"@type":"Answer","text":"GhostAction is a campaign where attackers use stolen GitHub credentials to push a malicious workflow, often named security-audit.yml, into repositories. The workflow reads secrets referenced in other workflows and exfiltrates them via HTTP requests to attacker-controlled servers. First exposed in September 2025, a new wave starting August 31, 2026 hit 772 repositories, 373 users, and 2,577 secrets. Teams hardening CI/CD pipelines against credential theft can follow supply chain security coverage on daily.dev."}},{"@type":"Question","name":"Is rotating secrets enough after a GhostAction GitHub Actions compromise?","acceptedAnswer":{"@type":"Answer","text":"No, rotating stolen secrets alone is insufficient because the GitHub credentials that let attackers inject the malicious workflow in the first place must also be revoked. These credentials may be shared or resold among multiple threat actors, so a rotated secret can be stolen again if the original access point remains open. Maintainers should also check git history, since the attack now reads committed history, not just the current tree. Maintainers responding to credential leaks can track incident response guidance like this on daily.dev."}},{"@type":"Question","name":"What data does the updated GhostAction malicious workflow steal from GitHub repositories?","acceptedAnswer":{"@type":"Answer","text":"The updated workflow scans both the working tree and the full git history for cloud and AI credentials, including SSH keys, Azure credentials, container registry tokens, database credentials, and AWS keys, then sends them in cleartext to a single hardcoded IP address. This goes beyond the original version, which only targeted CI/CD secrets already referenced in a repository's workflows. Developers auditing repositories for injected workflows can follow supply chain security news on daily.dev."}}]} ```