A malicious GitHub Actions workflow that researchers first documented more than a year ago has returned at a scale far beyond its original run, compromising roughly 1,900 GitHub accounts and targeting more than 30,000 repositories across some 3,000 users and organizations. The latest tally comes from an updated analysis published by the security firm GitGuardian, which has tracked the campaign, known as GhostAction, since it first surfaced in September 2025.
GhostAction works by committing a workflow file, disguised with routine-sounding names such as "security-audit.yml" or "Add Github Actions Security workflow," directly to a victim repository using the credentials of a compromised maintainer account. Once triggered by a push, the workflow scans the repository's existing automation for the names of secrets it already references, then exfiltrates their values to an external server. A newer version of the payload goes further, scanning a repository's full commit history — not just its current code — for hardcoded AWS keys, GitHub tokens, and API keys for services including Anthropic, OpenAI, and Google Cloud, according to a separate analysis from Socket, which examined an October 8 burst that hit two compromised maintainer accounts and a repository owned by Uber.
The numbers have climbed steadily. GitGuardian's original report counted 817 affected repositories and 327 compromised users, with roughly 3,325 secret names targeted. By early October, Socket had identified more than 500 compromised accounts tied to tens of thousands of repositories. GitGuardian's latest update, covering activity through October 13, puts the current wave at about 1,900 compromised accounts, with the heaviest injection phase arriving in an October 8–9 spike that alone touched roughly 28,000 newly affected repositories.
The technique illustrates a persistent weak point in open-source infrastructure: both Actions secrets and git history function as high-value, often under-monitored stores of credentials, and a single compromised maintainer account can expose every repository, fork, and organization that account can write to. Prominent projects were swept up in the latest wave — Socket's research identified the Pyxel game engine, which has more than 18,000 GitHub stars, and athenadriver, an Uber-owned repository reached because a compromised contributor held write access to it.
GitHub moved to block it, but older secrets remain exposed
GitHub began blocking the malicious workflow from executing on October 9, and follow-on waves pushed on October 10 and 12 reportedly failed to exfiltrate any secrets as a result. Still, GitGuardian cautioned that earlier, successful runs likely leaked credentials that many maintainers have not yet rotated — a pattern the firm says is itself fueling the campaign's spread, since some of the secrets collected in October had already been exposed in earlier waves.
Our data shows that GhostAction never really stopped.
GitGuardian analysis
Researchers describe the October wave as more improvised than the original campaign, with the attacker's payload evolving through at least three versions — each adding broader credential-matching patterns — over several weeks, rather than being deployed as a single finished tool. Neither GitGuardian nor Socket has attributed the campaign to a specific threat actor, and both say they are continuing to review the October wave against their own data.
What maintainers are being told to do
Both firms are urging affected organizations to treat any completed run of the injected workflow as a confirmed compromise rather than a near-miss. Recommended steps include rotating every secret named in the workflow file, revoking rather than simply rotating personal access tokens, scanning full git history — including unreachable commits — for hardcoded credentials, and reviewing cloud logs for unfamiliar access keys or new accounts created during the affected window.
Maintainers are also advised to remove the malicious workflow files, revoke sessions and OAuth grants tied to any compromised account, enable phishing-resistant multi-factor authentication, and require approval before Actions workflows from outside contributors can run — protections GitHub's own documentation recommends as a baseline for public repositories. GitHub has not issued a public statement on the campaign's overall scope.
