GhostAction Surge Hits About 1,900 GitHub Accounts in Bid to Steal Developer Secrets

Security firm GitGuardian reports that the GhostAction campaign spiked on October 8 and 9, 2026. Attackers compromised the GitHub accounts of about 1,900 users and targeted more than 30,000 repositories across 3,000 users and organisations. They attempted to extract 3,174 secrets from the automation systems of public repositories. GhostAction was first discovered in September 2025 and targets developer infrastructure on GitHub.

The attackers gain write access to repositories using stolen Personal Access Tokens or credentials harvested from infostealer logs and dumps. They then use the hijacked account to add a malicious automation workflow file, disguised with names such as "Security Audit" or "GitHub Actions Security". The goal is large-scale theft of CI/CD secrets, cloud credentials, package registry tokens (such as npm, PyPI and DockerHub) and AI provider API keys.

A newer wave, seen since August 31, 2026, pushed the malicious workflow to hundreds of repositories. GitGuardian describes it as more experimental and manual than earlier waves, with the payload changing over time. Its first version added a feature to scan a repository's git history for secrets, including AWS keys, GitHub and GitLab tokens, and AI-related secrets. Later versions captured surrounding context to pair AWS key IDs with their matching secret keys.