Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories
AI-summarised brief · reviewed before publication
Cybersecurity researchers uncovered a credential‑theft campaign that compromised two prominent open‑source maintainers, Takashi Kitao and Henry Wu, to deploy a malicious GitHub Actions workflow across more than 340 repositories. The attacker pushed the workflow, named “security‑audit.yml,” to 27 repositories using Kitao’s account and to 318 repositories using Wu’s account within a 16‑minute window. Since October 7, 2026, over 500 GitHub accounts have injected the workflow into tens of thousands of repositories, exfiltrating 3,325 secrets—including cloud, AI, and container registry credentials—to a hard‑coded IP address. The campaign, dubbed GhostAction, has impacted 817 repositories belonging to 327 users, with no malicious package releases yet reported. Developers are urged to remove the workflow, revoke compromised credentials, and audit forks for the same file.
💡 Why It Matters
- · The attack demonstrates how compromised maintainer accounts can weaponize supply‑chain trust, enabling large‑scale credential theft without direct user interaction.
- · It underscores the urgency for robust workflow vetting and real‑time credential monitoring in open‑source ecosystems.
