--- title: Hackers hijacked 1,900 GitHub accounts. Then they went... description: GhostAction, a supply chain attack campaign tracked by GitGuardian, compromised roughly 1,900 GitHub accounts and planted credential-stealing GitHub Actions... canonical: https://daily.dev/posts/hackers-hijacked-1-900-github-accounts-then-they-went-after-30-000-repos--jyzqln0ak twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Hackers hijacked 1,900 GitHub accounts. Then they went after 30,000 repos. | daily.dev og:description: GhostAction, a supply chain attack campaign tracked by GitGuardian, compromised roughly 1,900 GitHub accounts and planted credential-stealing GitHub Actions... og:url: https://daily.dev/posts/hackers-hijacked-1-900-github-accounts-then-they-went-after-30-000-repos--jyzqln0ak og:image: https://api.daily.dev/og/posts/JYzQLn0AK.png og:image:alt: Hackers hijacked 1,900 GitHub accounts. Then they went after 30,000 repos. og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Hackers hijacked 1,900 GitHub accounts. Then they went after 30,000 repos. **[The New Stack](https://daily.dev/sources/newstack)** · 4 min read · 0 upvotes · 0 comments ## Summary GhostAction, a supply chain attack campaign tracked by GitGuardian, compromised roughly 1,900 GitHub accounts and planted credential-stealing GitHub Actions workflows across more than 30,000 repositories. Unlike the earlier tj-actions/changed-files compromise, attackers used stolen developer credentials (likely leaked personal access tokens) to directly modify workflows, disguising them with names like security-audit.yml. The malicious jobs scanned full Git history using actions/checkout with fetch-depth:0 to harvest AWS keys, GitHub/GitLab PATs, Google/Firebase keys, and AI provider API keys (Anthropic, OpenAI, OpenRouter), exfiltrating them to a remote server. The biggest push occurred October 8-9, hitting about 3,000 users/organizations and targeting 3,174 secrets. GitHub's approval controls blocked many new workflows, but attackers reused 92 older malicious workflows, and by October 5 only 16% of affected repositories from the earlier August-September wave had been cleaned up. Security teams are urged to audit workflow changes, revoke compromised account access, and rotate all potentially exposed credentials, including those long deleted from current code but still present in Git history. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the GhostAction GitHub Actions attack and how does it steal secrets? GhostAction is a supply chain campaign that compromised about 1,900 GitHub accounts, likely via leaked personal access tokens, then added disguised workflows (named like security-audit.yml) to over 30,000 repositories. Using actions/checkout@v4 with fetch-depth:0, the workflows scanned full Git history for AWS keys, GitHub/GitLab PATs, Google/Firebase keys, and Anthropic, OpenAI, and OpenRouter API tokens, sending them over HTTP to 193.32.204.199. _Teams hardening CI/CD pipelines against credential theft follow security incident breakdowns like this on daily.dev._ ### How is the GhostAction attack different from the tj-actions/changed-files compromise? The tj-actions/changed-files incident poisoned a shared GitHub Action used by thousands of repositories, exploiting trust in a common dependency. GhostAction instead used stolen developer credentials to directly modify workflow files in victims' own repositories, with no vulnerability in GitHub Actions itself required, making it a credential-based attack rather than a dependency-poisoning one. _Developers comparing supply chain attack patterns track distinctions like this on daily.dev._ ### Why weren't repositories fully cleaned up after the GhostAction attack was discovered? By October 5, only 16% of the 772 repositories affected in the August and September campaign had been cleaned up, meaning 648 remained compromised. GitHub's approval controls stopped most new malicious workflow runs, but attackers recycled 92 older malicious workflows left over from earlier attacks, some tied to infrastructure active since September 2025, letting the campaign persist. _Security teams tracking slow incident remediation rates follow supply chain cleanup data on daily.dev._ ## Similar posts on daily.dev - [GhostAction Returns: Malicious “Security Audit” Workflows Now Mine Credentials from Entire Git Histories](https://daily.dev/posts/ghostaction-returns-malicious-security-audit-workflows-now-mine-credentials-from-entire-git-histo-9iwzmwu4v) · StepSecurity · 0 upvotes · 0 comments - [Is GitHub Actions Putting Your Software at Risk?](https://daily.dev/posts/is-github-actions-putting-your-software-at-risk--a2b2a1jji) · Atomic Spin · 0 upvotes · 0 comments - [GitHub Actions abused by Megalodon attack to slip malicious commits into 5,500 repos](https://daily.dev/posts/github-actions-abused-by-megalodon-attack-to-slip-malicious-commits-into-5-500-repos-iymmmkb5w) · CSO Online · 3 upvotes · 0 comments - [Large-Scale GitHub Actions Abuse Powers a Distributed cPanel...](https://daily.dev/posts/large-scale-github-actions-abuse-powers-a-distributed-cpanel--orhsquhdv) · Socket · 4 upvotes · 1 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#github](https://daily.dev/tags/github), [#cicd](https://daily.dev/tags/cicd), [#github-actions](https://daily.dev/tags/github-actions), [#secrets-management](https://daily.dev/tags/secrets-management) [View this post on daily.dev](https://daily.dev/posts/hackers-hijacked-1-900-github-accounts-then-they-went-after-30-000-repos--jyzqln0ak) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Hackers hijacked 1,900 GitHub accounts. Then they went after 30,000 repos.","url":"https://daily.dev/posts/hackers-hijacked-1-900-github-accounts-then-they-went-after-30-000-repos--jyzqln0ak","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/hackers-hijacked-1-900-github-accounts-then-they-went-after-30-000-repos--jyzqln0ak"},"datePublished":"2026-10-15T21:19:40.232Z","dateModified":"2026-10-15T21:50:30.676Z","description":"GhostAction, a supply chain attack campaign tracked by GitGuardian, compromised roughly 1,900 GitHub accounts and planted credential-stealing GitHub Actions...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/fb71c33e8a455aecd7742568409ba8c1?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/fb71c33e8a455aecd7742568409ba8c1?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The New Stack","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The New Stack","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/newstack","url":"https://daily.dev/sources/newstack"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/hackers-hijacked-1-900-github-accounts-then-they-went-after-30-000-repos--jyzqln0ak","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,github,cicd,github-actions,secrets-management","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The New Stack","item":"https://daily.dev/sources/newstack"},{"@type":"ListItem","position":3,"name":"Hackers hijacked 1,900 GitHub accounts. Then they went after 30,000 repos."}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/hackers-hijacked-1-900-github-accounts-then-they-went-after-30-000-repos--jyzqln0ak#faq","mainEntity":[{"@type":"Question","name":"What is the GhostAction GitHub Actions attack and how does it steal secrets?","acceptedAnswer":{"@type":"Answer","text":"GhostAction is a supply chain campaign that compromised about 1,900 GitHub accounts, likely via leaked personal access tokens, then added disguised workflows (named like security-audit.yml) to over 30,000 repositories. Using actions/checkout@v4 with fetch-depth:0, the workflows scanned full Git history for AWS keys, GitHub/GitLab PATs, Google/Firebase keys, and Anthropic, OpenAI, and OpenRouter API tokens, sending them over HTTP to 193.32.204.199. Teams hardening CI/CD pipelines against credential theft follow security incident breakdowns like this on daily.dev."}},{"@type":"Question","name":"How is the GhostAction attack different from the tj-actions/changed-files compromise?","acceptedAnswer":{"@type":"Answer","text":"The tj-actions/changed-files incident poisoned a shared GitHub Action used by thousands of repositories, exploiting trust in a common dependency. GhostAction instead used stolen developer credentials to directly modify workflow files in victims' own repositories, with no vulnerability in GitHub Actions itself required, making it a credential-based attack rather than a dependency-poisoning one. Developers comparing supply chain attack patterns track distinctions like this on daily.dev."}},{"@type":"Question","name":"Why weren't repositories fully cleaned up after the GhostAction attack was discovered?","acceptedAnswer":{"@type":"Answer","text":"By October 5, only 16% of the 772 repositories affected in the August and September campaign had been cleaned up, meaning 648 remained compromised. GitHub's approval controls stopped most new malicious workflow runs, but attackers recycled 92 older malicious workflows left over from earlier attacks, some tied to infrastructure active since September 2025, letting the campaign persist. Security teams tracking slow incident remediation rates follow supply chain cleanup data on daily.dev."}}]} ```