GhostAction Campaign Expands to Inject Malicious GitHub Workflows Stealing AWS Keys and Tokens
The GhostAction campaign has returned with an expanded technique that targets a wider range of credentials across hundreds of repositories. On October 8, two compromised maintainer accounts injected a malicious workflow named security-audit.yml into 346 GitHub repositories, including high-profile projects such as uber/athenadriver and kitao/pyxel. The workflow disguises itself as a security audit routine and executes automatically on every code push, exfiltrating credentials via HTTP requests to attacker-controlled servers. Unlike previous waves that only harvested GitHub Actions secrets, the new version also scans the working directory and full git history for forgotten credentials in older commits. Targeted data includes AWS access keys, GitHub and GitLab tokens, Google API keys, Slack and SendGrid tokens, OpenAI and Anthropic credentials, PyPI passwords, and crates.io tokens. Since October 7, more than 500 GitHub accounts have planted similar workflows, building on earlier campaigns that affected 817 repositories in September 2025 and 772 between August and September.
BoletimSecOct 13, 2026Translated from Portuguese