A credential theft campaign known as GhostAction has expanded its activity, reportedly targeting more than 30,000 GitHub repositories linked to around 3,000 users and organisations. According to cybersecurity company GitGuardian, a significant increase in activity was observed on October 8 and 9, 2026, following the compromise of approximately 1,900 GitHub accounts. Security researchers Gaetan Ferry and Guillaume Valadon stated that the campaign attempted to extract 3,174 secrets from continuous integration environments connected to public repositories. The activity highlights ongoing risks faced by software development environments, where compromised accounts and exposed credentials can provide attackers with access to sensitive resources across the software supply chain.
GhostAction refers to a supply chain attack campaign targeting developer infrastructure on GitHub. Initially identified in September 2025, the campaign involves attackers compromising legitimate developer accounts and using those accounts to introduce malicious GitHub Actions workflows into software repositories. Researchers have reported that attackers obtain write access through stolen Personal Access Tokens (PATs) or credentials collected from infostealer logs and credential dumps. After gaining access to a maintainer account, attackers reportedly upload malicious workflow files designed to appear legitimate, using names such as Security Audit or GitHub Actions Security. These workflows are intended to secretly collect sensitive information from development environments, including continuous integration and continuous deployment (CI/CD) secrets, cloud credentials, package registry tokens from services such as npm, PyPI and DockerHub, as well as artificial intelligence provider API keys.
GitGuardian reported that a new wave of GhostAction activity has been observed since August 31, 2026, with malicious workflows appearing across hundreds of repositories. The company described the latest activity as more experimental and manual compared with earlier campaigns, with attackers modifying their payloads over time. The first version of the updated payload reportedly introduced a git history secret scanning capability designed to identify exposed credentials within repository histories. Security researchers noted that the scanning process included detection patterns for AWS key identifiers, GitHub and GitLab tokens, AI related secrets and cloud API credentials. A later version expanded the capability by collecting additional context around AWS key discoveries to help identify matching secret access keys, while a third version added support for retrieving secret context during git history scans.
According to GitGuardian, the latest payload deployment occurred in multiple stages, beginning with 160 previously identified victims before expanding to approximately 28,000 new repositories between October 8 and 9. Additional waves were detected on October 10 and 12, although GitHub had started preventing the malicious workflow from executing from October 9, limiting the ability of later campaigns to extract secrets. Researchers also noted that some victims affected during the latest activity had previously been compromised during earlier GhostAction waves in September 2025 and August 2026. This suggests that attackers may be attempting to reuse access gained from credentials that were not rotated after previous incidents. The continued activity surrounding GhostAction reflects broader challenges in protecting software development environments, where a single compromised account can affect multiple repositories and connected services. Security teams are encouraged to strengthen account protection through multi factor authentication, regularly rotate exposed credentials, monitor repository activity and review GitHub Actions workflows for unexpected changes. As organisations increasingly depend on automated development pipelines and third party integrations, securing developer accounts and CI/CD environments remains an important part of reducing supply chain security risks.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
