Researchers at OpenSourceMalware have counted 790 GitHub repositories containing malicious workflows introduced by the GhostAction campaign. The tally covers publicly validated and recoverable repositories observed up to October 9.
The campaign abuses trusted developer accounts. Once an attacker gains write access to a maintainer’s repositories, they add a workflow that executes on every code push or manual trigger. This workflow exposes any secrets available to GitHub Actions and searches repository files for credential-like strings, including AWS access keys and tokens for GitHub, GitLab, Google, Slack, SendGrid, OpenAI, Anthropic, and OpenRouter.
The workflow also clones the complete Git history, allowing attackers to recover credentials that were later removed from current code but remain visible in older commits. In some cases it extracts surrounding lines near AWS key identifiers that may contain the corresponding secret. All collected data is transmitted in plaintext to attacker-controlled infrastructure.
The reach of the campaign extends across active projects, forks, and long-inactive repositories, indicating automated discovery of every repository the compromised accounts could modify. A separate surge on October 8 affected 346 repositories tied to two maintainer accounts, among them a project belonging to Uber.
Simply deleting the malicious workflow file does not resolve the incident. Any successful execution has already exposed credentials, and removal does not revoke stolen tokens or erase secrets present in historical commits. Recommended actions include revoking the affected account credentials, rotating every secret the workflow could access, and reviewing releases and cloud activity from the relevant period.
